CVE-2026-57738

Name of the Vulnerable Software and Affected Versions axiomthemes 777 versions prior to 1.13.1

Description The 777 theme for WordPress is subject to PHP Object Injection due to the deserialization of untrusted data. This allows unauthenticated attackers to inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update axiomthemes 777 to a version newer than 1.13.0.