CVE-2026-57770: Grand Photography Object Injection Flaw

CVE-2026-57770 Overview

CVE-2026-57770 is a PHP Object Injection vulnerability in the ThemeGoods Grand Photography WordPress theme. The flaw stems from deserialization of untrusted data [CWE-502] and affects all versions of Grand Photography up to and including 5.7.8. Unauthenticated attackers can send crafted serialized payloads over the network to trigger object injection within the theme.

When combined with a suitable POP (Property-Oriented Programming) gadget chain present in WordPress core or another installed plugin, exploitation can lead to remote code execution, arbitrary file operations, or full site compromise.

Critical Impact
Unauthenticated network attackers can trigger PHP object injection on affected sites, potentially leading to remote code execution and full site takeover.

Affected Products

ThemeGoods Grand Photography (grandphotography) WordPress theme versions up to and including 5.7.8
WordPress sites running the vulnerable theme with additional plugins or components exposing POP gadget chains
Any hosting environment executing the affected theme code without an upstream patch

Discovery Timeline

2026-07-13 - CVE-2026-57770 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57770

Vulnerability Analysis

The Grand Photography theme passes attacker-controllable input into a PHP deserialization routine, such as unserialize(), without validating or restricting the object types being reconstructed. When a serialized string is deserialized, PHP instantiates the encoded objects and invokes magic methods including __wakeup(), __destruct(), and __toString() on the resulting instances.

An unauthenticated attacker can submit a crafted serialized payload through the exposed theme entry point. If the WordPress installation contains classes whose magic methods perform sensitive operations, the attacker can chain those classes into a POP gadget that executes arbitrary code, writes files, or manipulates the database.

The vulnerability requires no authentication, no user interaction, and no elevated privileges, making it exploitable at scale against internet-facing WordPress sites running the affected theme.

Root Cause

The root cause is unsafe deserialization of user-supplied data [CWE-502]. The theme accepts serialized PHP data from an untrusted source and reconstructs objects without applying an allowlist via the allowed_classes option of unserialize() or replacing serialization with a safe format such as JSON.

Attack Vector

Exploitation occurs over the network against the WordPress HTTP endpoint that processes theme-controlled input. The attacker crafts a serialized PHP payload referencing gadget classes present in the target's WordPress core, plugins, or themes. Submitting the payload causes deserialization to invoke chained magic methods, resulting in unauthorized actions in the context of the web server user.

The deserialization sink and the specific input parameter are documented in the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2026-57770

Indicators of Compromise

Unexpected HTTP POST or GET requests to Grand Photography theme endpoints containing serialized PHP markers such as O:, a:, or s: followed by class or property definitions
New or modified PHP files inside wp-content/themes/, wp-content/plugins/, or wp-content/uploads/ that were not deployed by an administrator
WordPress administrator accounts, options, or scheduled cron entries appearing without a corresponding administrative action
Outbound network connections from the web server process to unknown hosts following requests to theme URLs

Detection Strategies

Inspect web server access logs for request bodies or query strings containing serialized PHP signatures targeting Grand Photography URLs
Deploy web application firewall rules that block payloads matching PHP serialization grammar on non-administrative endpoints
Enable PHP error and audit logging to capture calls to unserialize() and warnings from __wakeup() or __destruct() on unexpected classes
Baseline theme and plugin file hashes and alert on drift, particularly changes to .php files under wp-content/

Monitoring Recommendations

Forward WordPress, PHP-FPM, and reverse proxy logs to a centralized SIEM and correlate requests to the affected theme with subsequent file-system or process activity
Monitor the web server user for unexpected process spawns such as sh, bash, wget, curl, or python
Track creation of new administrator users and modifications to wp_options values including active_plugins and siteurl

How to Mitigate CVE-2026-57770

Immediate Actions Required

Identify all WordPress sites running the Grand Photography theme at version 5.7.8 or earlier and prioritize them for remediation
Restrict access to the affected theme endpoints at the web application firewall or reverse proxy until a patched release is applied
Rotate WordPress secret keys in wp-config.php, administrator passwords, and any API tokens if exploitation is suspected
Review recent file changes under wp-content/ and audit administrator accounts for unauthorized additions

Patch Information

At the time of publication, the advisory lists affected versions from n/a through <= 5.7.8. Administrators should consult the Patchstack WordPress Vulnerability Report for the latest fixed version and upgrade guidance from ThemeGoods.

Workarounds

Deactivate and remove the Grand Photography theme until a patched version is installed
Apply a virtual patch through a web application firewall to block requests containing PHP serialization markers on theme endpoints
Restrict access to the WordPress site to trusted IP ranges while remediation is planned
Disable dangerous PHP functions where feasible using the disable_functions directive in php.ini to reduce POP gadget impact

bash

# Example WAF rule to block PHP serialized payloads on theme endpoints
# ModSecurity rule (adapt paths and IDs to your environment)
SecRule REQUEST_URI "@contains /wp-content/themes/grandphotography/" \
  "phase:2,deny,status:403,id:1027706,\
   msg:'Possible PHP Object Injection attempt (CVE-2026-57770)',\
   chain"
  SecRule ARGS|REQUEST_BODY "@rx (?:^|[^a-zA-Z0-9])(O|a|s):\d+:" \
    "t:none"