What is the CVSS score of CVE-2026-57371?

CVE-2026-57371 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of WPJAM Basic are affected by CVE-2026-57371?

WPJAM Basic WordPress plugin versions through 7.0 contain a critical PHP object injection vulnerability (CVE-2026-57371, CVSS 8.8) that allows authenticated users to compromise WordPress site…

How to fix or mitigate CVE-2026-57371?

Within 24 hours, inventory all WordPress installations to identify WPJAM Basic plugin usage and determine affected versions (7.0 and below). Within 7 days, implement remediation by either uninstalling the plugin or applying strict role-based access controls to limit plugin interaction to essential administrators only; if access cannot be sufficiently restricted, disable the plugin until a security patch is available. Within 30 days, monitor Patchstack and official WordPress plugin repositories for a vendor security update, establish a testing and deployment plan to rapidly upgrade all instances to the patched version upon release.

WPJAM Basic CVE-2026-57371

EUVD-2026-43447 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-13 Patchstack

Deserialization Wpjam Basic WordPress Wordpress Plugin

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable plugin endpoint (AV:N/AC:L) requiring a low-privilege authenticated account (PR:L); PHP object injection can reach full CIA compromise via gadget chains (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:07 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through <= 7.0.

AnalysisAI

PHP Object Injection in the WPJAM Basic WordPress plugin (denishua) affects all versions up to and including 7.0, allowing an authenticated attacker to inject crafted serialized objects that are deserialized by the plugin. Reported by Patchstack and rated CVSS 8.8, it can lead to high-impact compromise (confidentiality, integrity, and availability) of the WordPress site, though exploitation requires at least low-level authenticated access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw is a classic CWE-502 Deserialization of Untrusted Data issue in PHP. WPJAM Basic (CPE cpe:2.3:a:denishua:wpjam_basic) passes attacker-influenced data into PHP's unserialize() (or an equivalent object-instantiating path) without validating or restricting the resulting object types. When such data is deserialized, PHP instantiates arbitrary objects, and any 'magic methods' (__wakeup, __destruct, __toString) present in the plugin, WordPress core, or other loaded plugins can be chained into a POP (Property-Oriented Programming) gadget chain. Depending on available gadgets, this escalates from object injection to file operations, SQL manipulation, or code execution - which is why the impact metrics are all rated High.

RemediationAI

No vendor-released patch version was identified in the available data, so upgrade to a fixed release once denishua publishes one (monitor the plugin changelog and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-0-php-object-injection-vulnerability). As immediate compensating controls, deactivate and remove the WPJAM Basic plugin if it is not essential (trade-off: loss of the plugin's functionality); restrict site registration and revoke untrusted low-privilege accounts to remove the PR:L foothold the attack needs (trade-off: limits open community features); and deploy a WordPress WAF such as Patchstack or an equivalent virtual patch to block PHP object-injection payloads to the plugin's endpoints (trade-off: may require tuning to avoid false positives). Because object-injection impact depends on POP gadget chains, also keeping WordPress core and all other plugins updated reduces available gadgets.