What is the CVSS score of CVE-2026-57744?

CVE-2026-57744 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of RT-Theme 18 are affected by CVE-2026-57744?

The rt18-extensions WordPress plugin (versions ≤2.5) contains a critical unauthenticated remote code execution vulnerability (CVE-2026-57744, CVSS 9.8) that allows attackers to completely compromise…

How to fix or mitigate CVE-2026-57744?

Within 24 hours: disable the rt18-extensions plugin on all WordPress instances and review access logs for potential exploitation attempts targeting the plugin. Within 7 days: remove the plugin entirely, deploy a replacement solution, and conduct a comprehensive security audit of all affected systems to identify compromise artifacts including backdoors, unauthorized accounts, and injected malware. Within 30 days: implement automated WordPress plugin vulnerability scanning in your deployment pipeline, establish a formal plugin inventory with versioning and continuous security monitoring, and deploy Web Application Firewall rules to block malicious serialized object injection patterns.

RT-Theme 18 CVE-2026-57744

EUVD-2026-43387 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-13 Patchstack

Deserialization Rt Theme 18 Extensions WordPress Wordpress Plugin

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network and unauthenticated per the sink, but rated AC:H because reliable impact requires locating a suitable POP gadget chain; full C/I/A when a chain is reached.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:38 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

AnalysisAI

PHP Object Injection in the RT-Theme 18 | Extensions plugin (rt18-extensions) for WordPress affects all versions up to and including 2.5, allowing remote attackers to inject arbitrary PHP objects by supplying crafted serialized data to an unsafe deserialization sink. Because the CVSS vector reports PR:N/UI:N, exploitation does not require authentication or user interaction, and impact escalates to full compromise (confidentiality, integrity, availability all High) when a usable POP gadget chain is present in the WordPress stack. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 base score reflects worst-case object-injection potential rather than confirmed in-the-wild activity.

Technical ContextAI

This is a classic CWE-502 Deserialization of Untrusted Data flaw in a WordPress theme-extension plugin distributed with the commercial RT-Theme 18 (vendor 'stmcan'). PHP object injection occurs when untrusted input reaches unserialize() (or is passed through a code path that triggers it), letting an attacker instantiate arbitrary PHP objects. The real-world impact hinges on the presence of 'POP' (Property-Oriented Programming) gadget chains - magic methods such as __wakeup, __destruct, or __toString in the plugin, WordPress core, or other active plugins - which the injected object can chain to reach file writes, SQL, or code execution. The affected component is identified by CPE cpe:2.3:a:stmcan:rt-theme_18_|_extensions:*:*:*:*:*:*:*:*, confirming the vendor/product but not narrowing to a specific vulnerable parameter or endpoint.

RemediationAI

No vendor-released patched version is identified in the available data - the affected range is 'through <= 2.5' with no fixed version stated, so administrators should monitor the vendor (stmcan) and the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/rt18-extensions/vulnerability/wordpress-rt-theme-18-extensions-plugin-2-5-php-object-injection-vulnerability) for a release above 2.5 and update as soon as one is published. As compensating controls until a fix ships: deploy a WordPress-aware WAF or Patchstack's virtual patch to block serialized-object payloads (strings containing patterns like O:<n>: or a:<n>: reaching plugin endpoints); if the extensions plugin's affected functionality is not required, deactivate the rt18-extensions plugin, accepting loss of the theme features it provides; and restrict access to plugin AJAX/admin-ajax and REST endpoints via network controls where feasible. Note that WAF signatures for object injection can be bypassed by encoding, so virtual patching is a stopgap, not a substitute for the vendor update.