CVE-2026-57744

CriticalCVSS 9.8

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

43th percentile - higher than 43% of all known CVEs

Summary

The RT-Theme 18 | Extensions (rt18-extensions) plugin up to version 2.5 contains a deserialization of untrusted data vulnerability allowing object injection. An attacker can remotely exploit this flaw to execute arbitrary code or manipulate data.

Risk Assessment

The organization risks server takeover, data theft, or complete system integrity compromise through remote code execution.

Recommendation

Immediately update the RT-Theme 18 | Extensions plugin to a version higher than 2.5 once a patch is released. Restrict access to the WordPress admin panel until then.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.