CVE-2026-24981
Published: 25 March 2026
Summary
CVE-2026-24981 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring identification, reporting, and correction of the deserialization flaw in the Visionary Core plugin through timely patching.
Prevents object injection by mandating validation of untrusted data inputs that could be deserialized in the vulnerable WordPress plugin.
Enables regular vulnerability scanning to identify the deserialization issue in the Visionary Core plugin and trigger remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP object injection (deserialization) in public-facing WordPress plugin allows low-privileged authenticated users to achieve arbitrary code execution (RCE) over the network; directly maps to exploitation of public-facing apps for initial access and exploitation for privilege escalation.
NVD Description
Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.
Deeper analysisAI
CVE-2026-24981 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the NooTheme Visionary Core WordPress plugin (noo-visionary-core). Published on 2026-03-25, it enables Object Injection and affects all versions from n/a through 1.4.9.
With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited by low-privileged authenticated users over the network with low attack complexity and no user interaction required. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability, such as arbitrary code execution through injected objects.
The Patchstack advisory provides further details on this PHP Object Injection issue in Visionary Core plugin version 1.4.9: https://patchstack.com/database/Wordpress/Plugin/noo-visionary-core/vulnerability/wordpress-visionary-core-plugin-1-4-9-php-object-injection-vulnerability?_s_id=cve.
Details
- CWE(s)