What is the CVSS score of EUVD-2026-43390?

EUVD-2026-43390 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

How to fix or mitigate EUVD-2026-43390?

Within 24 hours, conduct a complete inventory of WordPress installations to identify all instances of ThemeGoods Grand Photography theme version 5.7.8 or earlier and disable the theme immediately as a temporary mitigation measure. Within 7 days, contact ThemeGoods for an official patch timeline, evaluate alternative WordPress themes with established security track records, and deploy Web Application Firewall rules to block PHP object injection attack patterns targeting theme files. Within 30 days, complete migration to a replacement theme with active security maintenance, or if operational constraints require continued use, implement comprehensive WAF and IDS monitoring, establish input/output encoding standards across all custom code, and document a detailed incident response plan for potential exploitation scenarios.

Grand Photography EUVD-2026-43390

| CVE-2026-57770 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-13 Patchstack

WordPress Deserialization Grand Photography Wordpress Theme Themegoods

9.8

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify site running Grand Photography ≤5.7.8
Delivery

Craft serialized PHP object payload
Exploit

Send to unserialize endpoint
Execution

Trigger POP gadget chain on deserialization
Persist

Execute file write or SQL injection
Impact

Full site compromise

Vulnerability Assessment

Weakness	CWE CWE-502 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V1 - Encoding and Sanitization Safe deserialization, type allowlists MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the target site runs ThemeGoods Grand Photography at version 5.7.8 or earlier and that attacker-controlled input reaches the theme's unserialize() sink. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed for default installations, so a crafted network request suffices to inject an object. The practical limiting factor is gadget availability: turning object injection into concrete code execution or file/SQL impact depends on a usable POP gadget chain being present in WordPress core, the theme, or co-installed plugins - without such a chain, impact is reduced. Exploitation is also constrained to sites where the vulnerable theme is active.
Impact	The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a trivially reachable, unauthenticated, network-facing flaw with total system impact, which on paper is maximum priority. However, real-world risk is tempered by missing corroborating signals: no EPSS score was provided, there is no KEV listing, and no POC has been identified, so exploitation is theoretical rather than demonstrated. Object injection severity is also highly dependent on which gadget chains are actually reachable in a given install; if no usable POP chain exists in the deployed plugin/theme set, practical impact can be far lower than the H/H/H vector implies. Treat this as high-priority patch hygiene for any site running the theme, but note the 9.8 is a worst-case assessment and no evidence of active or automated exploitation exists in the provided data.
Exploit ScenarioDerived	An unauthenticated attacker crafts a serialized PHP object payload and submits it to a Grand Photography endpoint that unserializes user input; when the payload is deserialized it triggers a POP gadget chain present on the site, leading to actions such as arbitrary file write or SQL injection and potentially full site takeover. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only a single crafted HTTP request with no authentication or user interaction. No public exploit code has been identified, so an attacker would need to develop the gadget chain independently.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 13, 2026

PHP Object Injection in the ThemeGoods Grand Photography WordPress theme (all versions up to and including 5.7.8) lets remote attackers deliver crafted serialized data to an unsafe unserialize() sink, potentially achieving code execution, file operations, or SQL injection through POP gadget chains. The CVSS 9.8 rating reflects unauthenticated network exploitation (PR:N/UI:N) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

RemediationAI

No fixed version is stated in the available data (affected range is 'n/a through <= 5.7.8'), so no vendor-released patch is confirmed at time of analysis; monitor ThemeGoods and the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/grandphotography/vulnerability/wordpress-grand-photography-theme-5-7-8-php-object-injection-vulnerability) for a release above 5.7.8 and upgrade as soon as one is published. As compensating controls until then, deploy a WordPress WAF or Patchstack virtual patching to block serialized-object payloads reaching the theme's endpoints, restrict or disable the specific theme functionality that accepts user input where feasible (accepting possible loss of that feature), and audit the site for other plugins that expose POP gadget chains to reduce the impact of any object injection. Standard hardening - least-privilege database accounts and file-system permissions that limit web-server write access - reduces the blast radius of gadget-driven file or SQL operations.

Affected VersionsENISA

Grand Photography 0 ≤5.7.8

Affected Packages

euvd grand_photography no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Grand Photography is a commercial WordPress theme sold by ThemeGoods for photography and portfolio sites. The flaw is CWE-502 (Deserialization of Untrusted Data): PHP code passes attacker-controllable input into unserialize() without validation, allowing an attacker to instantiate arbitrary PHP objects. On its own object injection is inert, but WordPress and its bundled libraries expose 'POP gadget' chains (magic methods such as __wakeup/__destruct) that can be reached during unserialization to escalate into file deletion, arbitrary file writes, SQL injection, or remote code execution. The CPE cpe:2.3:a:themegoods:grand_photography:*:*:*:*:*:*:*:* confirms the affected component is the theme itself rather than WordPress core.

Know when Grand Photography gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Unauthenticated network-reachable unserialize sink (AV:N/AC:L/PR:N/UI:N); worst-case gadget-driven RCE justifies C:H/I:H/A:H, though real impact depends on available POP chains.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

Executive ViewAI

Why It Matters

The ThemeGoods Grand Photography WordPress theme (versions through 5.7.8) contains a critical PHP object injection vulnerability allowing unauthenticated attackers to achieve remote code execution on affected web servers. This impacts any organization using this theme, creating immediate risk of complete server compromise, data theft, and website manipulation. With no vendor patch available, organizations must prioritize theme replacement or removal as the only viable remediation.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: immediate disabling of the vulnerable theme to eliminate the primary attack vector; deployment of Web Application Firewall rules to detect and block PHP serialized object patterns in HTTP requests; implementation of strict input validation and output encoding across the WordPress platform; continuous monitoring through WAF and Intrusion Detection System for exploitation attempts; and preparation of an incident response and forensic investigation plan for potential compromise detection and remediation.

Threat Intelligence Overview

EPSS Score

0.6%

Top 57% exploitable

Prevalence

Low

niche commercial WordPress photography theme, limited install base

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.6%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.