CVE-2026-57744

Name of the Vulnerable Software and Affected Versions RT-Theme 18 | Extensions versions prior to 2.6

Description The RT-Theme 18 Responsive WordPress Theme plugin is susceptible to PHP Object Injection due to the deserialization of untrusted data. This allows unauthenticated attackers to inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update RT-Theme 18 | Extensions to a version newer than 2.5.