Cyber Posture

CVE-2026-24969

High

Published: 25 March 2026

Published
25 March 2026
Modified
24 April 2026
KEV Added
Patch
CVSS Score 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0006 19.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24969 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents path traversal vulnerabilities like CVE-2026-24969 by enforcing input validation on pathname inputs to restrict access to intended directories.

prevent

Requires timely identification, reporting, and remediation of flaws such as this path traversal issue in the Instant VA theme, eliminating the vulnerability through patching.

prevent

Enforces access control policies to limit low-privilege users from performing unauthorized file deletions outside restricted paths exploited by this CVE.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Why these techniques?

Public-facing WordPress theme vuln directly enables T1190 exploitation; path traversal facilitates arbitrary file deletion (T1070.004) and data destruction for DoS impact (T1485).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Instant VA instantva allows Path Traversal.This issue affects Instant VA: from n/a through <= 1.0.1.

Deeper analysisAI

CVE-2026-24969 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, corresponding to CWE-22, in the Instant VA WordPress theme developed by designingmedia under the name instantva. This issue affects Instant VA versions from n/a through 1.0.1, enabling path traversal attacks within the theme's file handling mechanisms.

The vulnerability has a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), indicating exploitation over the network with low attack complexity, requiring only low privileges such as a subscribed user account. Attackers can leverage this to perform arbitrary file deletion, resulting in high availability impact through denial of service, while confidentiality and integrity impacts are none due to the changed scope.

Patchstack's advisory (https://patchstack.com/database/Wordpress/Theme/instantva/vulnerability/wordpress-instant-va-theme-1-0-1-arbitrary-file-deletion-vulnerability?_s_id=cve) details the arbitrary file deletion vulnerability specifically in Instant VA WordPress theme version 1.0.1.

Details

CWE(s)

CVEs Like This One

CVE-2025-65879Shared CWE-22
CVE-2026-31913Shared CWE-22
CVE-2025-68907Shared CWE-22
CVE-2025-6989Shared CWE-22
CVE-2024-54291Shared CWE-22
CVE-2025-14868Shared CWE-22
CVE-2026-33293Shared CWE-22
CVE-2024-8898Shared CWE-22
CVE-2025-2328Shared CWE-22
CVE-2025-66251Shared CWE-22

References