CVE-2026-57770

CriticalCVSS 9.8

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

43th percentile - higher than 43% of all known CVEs

Summary

The Grand Photography WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This issue affects all versions up to and including 5.7.8.

Risk Assessment

An attacker can remotely execute arbitrary code or manipulate application objects, potentially leading to full site compromise.

Recommendation

Immediately update the Grand Photography plugin to the latest available version that addresses this vulnerability.

Other vulnerabilities in Grand Photography

See all

CVE-2026-57769High
The Grand Photography plugin version 5.7.8 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
CVE-2026-39603Medium
The Grand Photography WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated administrator.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.