CVE-2026-24970
Published: 25 March 2026
Summary
CVE-2026-24970 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of the path traversal flaw in the Energox theme, directly eliminating the vulnerability enabling arbitrary file deletion.
Mandates validation of information inputs such as pathnames to prevent traversal sequences from being processed, directly countering the CWE-22 vulnerability exploited here.
Enforces least privilege to restrict low-privileged WordPress users and associated processes from performing arbitrary file deletions across the system.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing WordPress theme (authenticated low-priv access) directly enables exploitation of the web app (T1190) for arbitrary file deletion, which maps to data destruction for availability impact/DoS (T1485).
NVD Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Energox energox allows Path Traversal.This issue affects Energox: from n/a through <= 1.2.
Deeper analysisAI
CVE-2026-24970 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, corresponding to CWE-22, in the Energox WordPress theme developed by designingmedia. This issue affects Energox versions from n/a through 1.2, enabling path traversal attacks. The vulnerability carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), indicating high severity primarily due to its potential for availability disruption.
Attackers with low privileges, such as authenticated low-level WordPress users, can exploit this vulnerability remotely over the network with low complexity and no user interaction. Exploitation changes scope and allows arbitrary file deletion across the system, leading to high-impact denial of service without compromising confidentiality or integrity.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/energox/vulnerability/wordpress-energox-theme-1-2-arbitrary-file-deletion-vulnerability?_s_id=cve documents this as an arbitrary file deletion vulnerability in the Energox theme version 1.2 and provides guidance on associated mitigations.
Details
- CWE(s)