CVE-2026-24969
Published: 25 March 2026
Summary
CVE-2026-24969 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-24969 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, corresponding to CWE-22, in the Instant VA WordPress theme developed by designingmedia under the name instantva. This issue affects Instant VA versions from n/a through 1.0.1, enabling path traversal attacks within the theme's file handling mechanisms.
The vulnerability has a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), indicating exploitation over the network with low attack complexity, requiring only low privileges such as a subscribed user account. Attackers can leverage this to perform arbitrary file deletion, resulting in high availability impact through denial of service, while confidentiality and integrity impacts are none due to the changed scope.
Patchstack's advisory (https://patchstack.com/database/Wordpress/Theme/instantva/vulnerability/wordpress-instant-va-theme-1-0-1-arbitrary-file-deletion-vulnerability?_s_id=cve) details the arbitrary file deletion vulnerability specifically in Instant VA WordPress theme version 1.0.1.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15578
Vulnerability details
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Instant VA instantva allows Path Traversal.This issue affects Instant VA: from n/a through <= 1.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Public-facing WordPress theme vuln directly enables T1190 exploitation; path traversal facilitates arbitrary file deletion (T1070.004) and data destruction for DoS impact (T1485).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents path traversal vulnerabilities like CVE-2026-24969 by enforcing input validation on pathname inputs to restrict access to intended directories.
Requires timely identification, reporting, and remediation of flaws such as this path traversal issue in the Instant VA theme, eliminating the vulnerability through patching.
Enforces access control policies to limit low-privilege users from performing unauthorized file deletions outside restricted paths exploited by this CVE.