Cyber Posture

CVE-2026-24954

HighRCE

Published: 03 February 2026

Published
03 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 21.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24954 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Timely flaw remediation through patching directly eliminates the deserialization of untrusted data vulnerability in WpEvently versions up to 5.0.8.

prevent

Information input validation ensures untrusted user-supplied data is checked and sanitized before deserialization, blocking object injection exploits.

detect

Vulnerability scanning identifies the presence of CVE-2026-24954 in WordPress plugins like WpEvently, enabling proactive patching.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Deserialization/object injection vuln in public-facing WordPress plugin allows remote exploitation by low-privileged authenticated users, directly enabling T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation) to achieve RCE/full compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.0.8.

Deeper analysisAI

CVE-2026-24954 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the WpEvently WordPress plugin developed by magepeopleteam, also referred to as mage-eventpress. The issue enables Object Injection and affects all versions of the plugin up to and including 5.0.8. Published on 2026-02-03, it carries a CVSS v3.1 base score of 8.8 (High), reflecting its severity due to network accessibility and potential for significant impact.

Attackers with low privileges, such as authenticated users (PR:L), can exploit this vulnerability remotely (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). Exploitation involves supplying untrusted data for deserialization, leading to object injection that grants high confidentiality (C:H), integrity (I:H), and availability (A:H) impacts within the unscoped scope (S:U), potentially allowing remote code execution or full compromise of the affected WordPress site.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-5-0-8-deserialization-of-untrusted-data-vulnerability?_s_id=cve, which documents the vulnerability in the context of the WordPress plugin ecosystem.

Details

CWE(s)

CVEs Like This One

CVE-2026-27685Shared CWE-502
CVE-2025-14476Shared CWE-502
CVE-2025-60215Shared CWE-502
CVE-2025-36072Shared CWE-502
CVE-2025-59245Shared CWE-502
CVE-2026-22346Shared CWE-502
CVE-2026-24978Shared CWE-502
CVE-2026-24981Shared CWE-502
CVE-2025-50004Shared CWE-502
CVE-2026-3328Shared CWE-502

References