CVE-2026-57738

CriticalCVSS 9.8

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

43th percentile - higher than 43% of all known CVEs

Summary

The 777 triple-seven WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 1.13.0.

Risk Assessment

An attacker can remotely execute arbitrary code or take over the WordPress site by sending crafted data for deserialization.

Recommendation

Immediately update the 777 triple-seven plugin to a version newer than 1.13.0 if available, or temporarily disable it.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.