CVE-2026-24989
Published: 25 March 2026
Summary
CVE-2026-24989 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-24989 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the FantasticPlugins SUMO Affiliates Pro (affs) WordPress plugin, enabling Object Injection. The issue affects all versions of the plugin from n/a through those prior to 11.4.0. Published on 2026-03-25, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high impacts across confidentiality, integrity, and availability.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows Object Injection, potentially leading to arbitrary code execution or other severe compromises on the affected WordPress site, as reflected in the high CVSS impact metrics.
Patchstack advisories recommend updating the SUMO Affiliates Pro plugin to version 11.4.0 or later to mitigate the vulnerability, as this release addresses the Object Injection flaw in the deserialization process.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15607
Vulnerability details
Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote deserialization/object injection RCE in a public-facing WordPress plugin directly enables T1190 (Exploit Public-Facing Application) for initial access and T1059.004 (Unix Shell) for arbitrary command execution on the server.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-24989 by requiring timely remediation through patching the SUMO Affiliates Pro plugin to version 11.4.0 or later.
Prevents object injection from deserialization of untrusted data by enforcing validation and sanitization of inputs before deserialization in the plugin.
Identifies the deserialization vulnerability in the WordPress plugin through regular vulnerability scanning, enabling proactive patching.