CVE-2026-57371
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The WPJAM Basic plugin version 7.0 and earlier contains a deserialization of untrusted data vulnerability allowing object injection. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.
Risk Assessment
The risk involves potential server takeover via malicious object injection, leading to data theft, content manipulation, or full site compromise.
Recommendation
Immediately update WPJAM Basic to a version higher than 7.0, which includes a fix for this vulnerability. Also restrict access to the WordPress admin panel to trusted users only.
Other vulnerabilities in WPJAM Basic
See all- CVE-2026-61966Critical
Subscriber SQL Injection vulnerability in WPJAM Basic versions up to 7.0.1. A user with subscriber role can execute arbitrary SQL queries.
- CVE-2026-66432High
Subscriber Sensitive Data Exposure vulnerability in WPJAM Basic versions up to 7.0.2.1.
- CVE-2026-57372High
SSRF vulnerability in the WPJAM Basic plugin allows an attacker to send requests from the server to internal network resources. The issue affects versions up to and including 7.0.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through <= 7.0.