RT-Theme 18 CVE-2026-57744

The core condition is that attacker-controlled input reaches an unsafe deserialization (unserialize) sink within the rt18-extensions plugin on a site running RT-Theme 18 | Extensions version 2.5 or earlier. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are required, and the vector is network-facing. The critical LIMITING factor for object injection is that meaningful impact (RCE, file write, SQL) requires a usable POP gadget chain present in the plugin, WordPress core, or another active plugin; absent such a chain, the object injection may produce limited or no exploitable effect. Exploitation is further limited to installations where the vulnerable plugin is active and the affected endpoint is reachable.

Signals are partially conflicting and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) presents this as trivially exploitable and unauthenticated, which is Patchstack's standard scoring for PHP object injection. However, that assumes a reachable gadget chain exists; without one, object injection often yields limited or no direct impact, so the effective severity can be lower than 9.8 in many deployments. No EPSS score was provided, so exploitation probability cannot be quantified. There is no KEV listing and no evidence of a public POC, meaning this is not currently confirmed as actively exploited - the priority is driven by the theoretical severity and network-reachable, unauthenticated attack surface, not by observed attacks. Treat as high-priority-to-patch but note the real-world exploitability depends on the specific gadget landscape of each site.

An unauthenticated attacker crafts a serialized PHP object payload targeting a gadget chain available in the WordPress installation and submits it to the vulnerable rt18-extensions input over the network (AV:N/AC:L/PR:N/UI:N). When the plugin deserializes the data, the injected object's magic methods fire, potentially leading to arbitrary file write, SQL manipulation, or code execution and full site takeover. No public POC is currently identified, so an attacker would need to develop the payload and locate a suitable gadget chain themselves.