Deserialization of Untrusted Data in Grand Photography

Executive Summary

CVE-2026-57770 is a high-severity PHP Object Injection vulnerability found in the WordPress Grand Photography Theme versions 5.7.8 and below.

This vulnerability arises from deserialization of untrusted data, which allows attackers to inject malicious objects into the application.

Exploiting this flaw can enable attackers to perform code injection, SQL injection, path traversal, denial of service, and other malicious activities if a suitable POP (Property Oriented Programming) chain exists.

Importantly, the vulnerability is unauthenticated, meaning attackers do not need prior access or credentials to exploit it.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized code execution, data breaches through SQL injection, unauthorized file access via path traversal, and service disruption through denial of service attacks.

Because the vulnerability is unauthenticated, attackers can exploit it remotely without needing any credentials, increasing the risk of compromise.

If exploited, it could lead to complete system compromise, data loss, or downtime, severely affecting the security and availability of your website.

Useful 0 Not Useful 0

Detection Guidance

There is no specific information provided about detection commands or methods for this vulnerability in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the Patchstack mitigation rule to block attacks targeting this vulnerability until an official patch is released.

It is advised to update the Grand Photography theme to a version above 5.7.8 once an official fix is available.

You may also seek assistance from your hosting provider or a developer to help implement these mitigations.

Useful 0 Not Useful 0