CVE-2026-24974
Published: 25 March 2026
Summary
CVE-2026-24974 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the deserialization vulnerability by patching the affected CitiLights WordPress theme versions up to 3.7.1.
Information input validation prevents exploitation by checking and sanitizing untrusted data before deserialization in the vulnerable theme.
Memory protection mechanisms like ASLR and DEP mitigate arbitrary code execution from object injection during deserialization.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP object injection via unsafe deserialization in a public-facing WordPress theme directly enables remote exploitation of the application (T1190) from a low-privileged account, resulting in arbitrary code execution that can deploy a web shell (T1505.003) or invoke Unix shell commands (T1059.004) and achieve privilege escalation to full site compromise (T1068).
NVD Description
Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.
Deeper analysisAI
CVE-2026-24974 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the NooTheme CitiLights (noo-citilights) WordPress theme, enabling object injection. The issue affects all versions of CitiLights from n/a through 3.7.1.
The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network with low attack complexity. It requires low privileges (such as a subscribed contributor role in WordPress), no user interaction, and unchanged scope, allowing attackers to achieve high impacts on confidentiality, integrity, and availability, potentially leading to full compromise of the affected site.
Patchstack has published an advisory detailing the PHP object injection vulnerability in the WordPress CitiLights theme up to version 3.7.1, available at https://patchstack.com/database/Wordpress/Theme/noo-citilights/vulnerability/wordpress-citilights-theme-3-7-1-php-object-injection-vulnerability?_s_id=cve. The CVE was published on 2026-03-25.
Details
- CWE(s)