CVE-2026-24974

HighRCE

Published: 25 March 2026

Published

25 March 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0034 26.2th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-24974 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-24974 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the NooTheme CitiLights (noo-citilights) WordPress theme, enabling object injection. The issue affects all versions of CitiLights from n/a through 3.7.1.

The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network with low attack complexity. It requires low privileges (such as a subscribed contributor role in WordPress), no user interaction, and unchanged scope, allowing attackers to achieve high impacts on confidentiality, integrity, and availability, potentially leading to full compromise of the affected site.

Patchstack has published an advisory detailing the PHP object injection vulnerability in the WordPress CitiLights theme up to version 3.7.1, available at https://patchstack.com/database/Wordpress/Theme/noo-citilights/vulnerability/wordpress-citilights-theme-3-7-1-php-object-injection-vulnerability?_s_id=cve. The CVE was published on 2026-03-25.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-15588

Vulnerability details

Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.

CWE(s): CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

PHP object injection via unsafe deserialization in a public-facing WordPress theme directly enables remote exploitation of the application (T1190) from a low-privileged account, resulting in arbitrary code execution that can deploy a web shell (T1505.003) or invoke Unix shell commands (T1059.004) and achieve privilege escalation to full site compromise (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0