Executive brief
WPJAM Basic, a popular WordPress plugin used for site optimization and management, is vulnerable to a security flaw that could allow an attacker to take control of a website. By exploiting this issue, a logged-in user with basic permissions could potentially execute malicious code, access sensitive data, or disrupt site operations. This vulnerability is particularly concerning as it can be used in automated attacks against many websites simultaneously.
Technical details
A Deserialization of Untrusted Data vulnerability (CWE-502) exists in the denishua WPJAM Basic plugin through version 7.0. The flaw allows for PHP Object Injection when the plugin improperly handles user-supplied input during deserialization. An attacker with at least Contributor-level privileges can exploit this to inject a PHP object, which, if a suitable POP (Property-Oriented Programming) chain is present on the server, can lead to remote code execution, SQL injection, or file system traversal. The issue is resolved in version 7.0.1.
Affected products
- denishua WPJAM Basic <= 7.0
Timeline
- 2026-04-25: disclosed: Reported by hhhai to Patchstack
- 2026-07-07: advisory: Patchstack published advisory and mitigation rules
- 2026-07-13: advisory: NVD published CVE-2026-57371
- 2026-07-13: patched: Version 7.0.1 confirmed as patched version