WPJAM Basic CVE-2026-57371

Exploitation requires the WPJAM Basic plugin (versions n/a through 7.0) to be installed and active, and - per the CVSS PR:L metric - the attacker must hold at least a low-privileged authenticated account on the target WordPress site (e.g., a subscriber or contributor obtained via open self-registration). The attack is network-based (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N), so once authenticated the attacker can send the malicious serialized payload directly. The realistic exploitation limit is twofold: the required authenticated foothold, and the dependence on a usable POP gadget chain in the installed WordPress/plugin stack for the object injection to reach high impact.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full CIA impact - a genuinely serious combination for an internet-facing WordPress plugin. However, several risk-tempering signals apply: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public exploit code was referenced, so real-world weaponization is unproven. The PR:L requirement means an attacker needs some authenticated foothold (e.g., a subscriber/contributor account), which meaningfully limits mass, unauthenticated exploitation. In practice this rates as a real priority for sites running the plugin with open registration, but as moderate rather than emergency risk absent EPSS/KEV evidence of exploitation in the wild.

An attacker registers or obtains a low-privilege account on a WordPress site running WPJAM Basic <= 7.0, then submits a crafted serialized PHP object to a plugin input that reaches unserialize(). When the plugin deserializes the payload, a POP gadget chain in WordPress or loaded plugins fires, letting the attacker read/write files, tamper with the database, or execute code. No public proof-of-concept exploit was identified at time of analysis.