Is CVE-2026-57744 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57744 being exploited in the wild.

How severe is CVE-2026-57744?

Critical severity, with a CVSS score of 9.8, published 13 July 2026.

Which products and versions are affected?

stmcan RT-Theme 18 | Extensions (rt18-extensions) <= 2.5.

Is there a fix for CVE-2026-57744?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-57744 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57744?

Check whether you run Stmcan RT-Theme 18 Extensions. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57744: stmcan RT-Theme 18 Extensions PHP object injection

Q: Is there a fix for CVE-2026-57744?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-57744 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57744?

Check whether you run Stmcan RT-Theme 18 Extensions. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57744 · Severity: critical · CVSS 9.8 · Published 2026-07-13

The RT-Theme 18 Extensions plugin for WordPress is vulnerable to a critical security flaw that allows attackers to inject malicious objects into the website's memory. This could lead to complete site takeover, unauthorized data access, or the deletion of critical files. Because this can be exploited remotely without any login credentials, it poses a significant risk to business operations and data integrity.

Technologies: Stmcan RT-Theme 18 Extensions. Vendors: Stmcan.

Quick answers

Is CVE-2026-57744 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57744 being exploited in the wild.
How severe is CVE-2026-57744?: Critical severity, with a CVSS score of 9.8, published 13 July 2026.
Which products and versions are affected?: stmcan RT-Theme 18 | Extensions (rt18-extensions) <= 2.5.
Is there a fix for CVE-2026-57744?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57744 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57744?: Check whether you run Stmcan RT-Theme 18 Extensions. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Deserialization of Untrusted Data vulnerability (CWE-502) exists in the stmcan RT-Theme 18 | Extensions (rt18-extensions) plugin through version 2.5. The flaw allows for PHP Object Injection when the application processes specially crafted input without proper validation. An unauthenticated remote attacker can exploit this to inject arbitrary PHP objects, which, if a suitable POP (Property Oriented Programming) chain is present in the environment, can lead to remote code execution, file manipulation, or database compromise. As of the advisory date, no official patch has been released by the vendor.

Affected products

stmcan RT-Theme 18 | Extensions (rt18-extensions) <= 2.5

Timeline

2026-01-31: disclosed: Reported by Bonds to Patchstack
2026-07-06: advisory: Patchstack published the vulnerability details
2026-07-13: advisory: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.