CVE-2026-24981
Published: 25 March 2026
Summary
CVE-2026-24981 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 26.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-24981 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the NooTheme Visionary Core WordPress plugin (noo-visionary-core). Published on 2026-03-25, it enables Object Injection and affects all versions from n/a through 1.4.9.
With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited by low-privileged authenticated users over the network with low attack complexity and no user interaction required. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability, such as arbitrary code execution through injected objects.
The Patchstack advisory provides further details on this PHP Object Injection issue in Visionary Core plugin version 1.4.9: https://patchstack.com/database/Wordpress/Plugin/noo-visionary-core/vulnerability/wordpress-visionary-core-plugin-1-4-9-php-object-injection-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15602
Vulnerability details
Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP object injection (deserialization) in public-facing WordPress plugin allows low-privileged authenticated users to achieve arbitrary code execution (RCE) over the network; directly maps to exploitation of public-facing apps for initial access and exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring identification, reporting, and correction of the deserialization flaw in the Visionary Core plugin through timely patching.
Prevents object injection by mandating validation of untrusted data inputs that could be deserialized in the vulnerable WordPress plugin.
Enables regular vulnerability scanning to identify the deserialization issue in the Visionary Core plugin and trigger remediation.