CVE-2026-24954
Published: 03 February 2026
Summary
CVE-2026-24954 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-24954 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the WpEvently WordPress plugin developed by magepeopleteam, also referred to as mage-eventpress. The issue enables Object Injection and affects all versions of the plugin up to and including 5.0.8. Published on 2026-02-03, it carries a CVSS v3.1 base score of 8.8 (High), reflecting its severity due to network accessibility and potential for significant impact.
Attackers with low privileges, such as authenticated users (PR:L), can exploit this vulnerability remotely (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). Exploitation involves supplying untrusted data for deserialization, leading to object injection that grants high confidentiality (C:H), integrity (I:H), and availability (A:H) impacts within the unscoped scope (S:U), potentially allowing remote code execution or full compromise of the affected WordPress site.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-5-0-8-deserialization-of-untrusted-data-vulnerability?_s_id=cve, which documents the vulnerability in the context of the WordPress plugin ecosystem.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5193
Vulnerability details
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.0.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization/object injection vuln in public-facing WordPress plugin allows remote exploitation by low-privileged authenticated users, directly enabling T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation) to achieve RCE/full compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation through patching directly eliminates the deserialization of untrusted data vulnerability in WpEvently versions up to 5.0.8.
Information input validation ensures untrusted user-supplied data is checked and sanitized before deserialization, blocking object injection exploits.
Vulnerability scanning identifies the presence of CVE-2026-24954 in WordPress plugins like WpEvently, enabling proactive patching.