What is the CVSS score of CVE-2026-57738?

CVE-2026-57738 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of 777 (WordPress Theme) are affected by CVE-2026-57738?

The axiomthemes '777' WordPress theme (versions up to 1.13.0) contains a critical remote vulnerability (CVSS 9.8) that permits unauthenticated attackers to take over affected WordPress websites…

How to fix or mitigate CVE-2026-57738?

Within 24 hours, audit all WordPress installations to identify those running axiomthemes '777' theme and document version numbers in use across the organization. Within 7 days, disable the axiomthemes '777' theme on all production sites immediately and replace it with an alternative WordPress theme; do not wait for a vendor patch to arrive. Within 30 days, deploy Web Application Firewall (WAF) rules configured to block requests containing serialized PHP objects, implement WordPress security monitoring to detect exploitation attempts targeting object instantiation, establish automated inventory tracking for WordPress themes and plugins, and monitor all WordPress error logs and PHP logs for signs of compromise.

777 (WordPress Theme) CVE-2026-57738

EUVD-2026-43383 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-13 Patchstack

WordPress Deserialization 777 Wordpress Theme Axiomthemes

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote unauthenticated (AV:N/PR:N/UI:N), but AC:H because reliable impact requires a usable POP gadget chain; full C/I/A impact assumed when a chain exists.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:40 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.

AnalysisAI

Remote PHP object injection in the axiomthemes '777' (triple-seven) WordPress theme allows attackers to instantiate arbitrary PHP objects by supplying crafted serialized data to a vulnerable unserialize() call, affecting all versions up to and including 1.13.0. With the reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8, an unauthenticated network attacker can achieve high-impact compromise if a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the '777' premium WordPress theme by axiomthemes (CPE cpe:2.3:a:axiomthemes:777). The root cause is CWE-502, Deserialization of Untrusted Data: the theme passes attacker-influenced input into PHP's unserialize() without validating or restricting the object types produced. In WordPress themes this typically arises from unserializing request parameters, cookies, transients, or option values. The security impact of object injection depends on the availability of 'POP' (Property-Oriented Programming) gadget chains within the theme, WordPress core, or active plugins - magic methods such as __wakeup() or __destruct() can be abused to escalate object injection into file operations, SQL access, or code execution.

RemediationAI

No vendor-released patch version is identified in the available data; the input only specifies affected versions through <= 1.13.0. Review the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/triple-seven/vulnerability/wordpress-777-theme-1-13-0-php-object-injection-vulnerability) for the vendor-supplied fixed release and upgrade to it once confirmed. Until a patched version is verified, apply compensating controls: deploy a WAF or Patchstack virtual patch to block serialized-object payloads (strings containing patterns like 'O:' or 'a:') to theme endpoints; restrict or disable the specific theme functionality that consumes serialized input if identifiable; and consider switching to an alternative theme on high-value sites, accepting the trade-off of layout/feature changes. Note that WAF rules on serialized data can produce false positives against legitimate serialized traffic and are not a substitute for the official fix.