Quick answers
- Is CVE-2026-57770 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-57770 being exploited in the wild.
- How severe is CVE-2026-57770?
- Critical severity, with a CVSS score of 9.8, published 13 July 2026.
- Which products and versions are affected?
- ThemeGoods Grand Photography <= 5.7.8.
- Is there a fix for CVE-2026-57770?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-57770 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-57770?
- Check whether you run ThemeGoods Grand Photography at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A PHP Object Injection vulnerability exists in the ThemeGoods Grand Photography theme for WordPress (versions up to and including 5.7.8) due to the deserialization of untrusted data. This flaw allows an unauthenticated remote attacker to inject arbitrary PHP objects. If a suitable Property-Oriented Programming (POP) chain is present within the environment, the attacker could achieve remote code execution, perform SQL injection, or conduct path traversal. As of the advisory date, no official patch has been released by the vendor.
Affected products
- ThemeGoods Grand Photography <= 5.7.8
Timeline
- 2026-01-02: other: Vulnerability reported by Tran Nguyen Bao Khanh
- 2026-07-09: advisory: Patchstack published advisory
- 2026-07-13: disclosed: CVE published to NVD