What is the CVSS score of CVE-2026-24974?

CVE-2026-24974 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Citilights are affected by CVE-2026-24974?

CVE-2026-24974 presents significant security risk, a insecure deserialization vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2026-24974?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Citilights CVE-2026-24974

EUVD-2026-15588 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-vqjh-xqjg-g4p7

Deserialization Citilights

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15588

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.

AnalysisAI

A PHP Object Injection vulnerability exists in NooTheme CitiLights WordPress theme through version 3.7.1, stemming from unsafe deserialization of untrusted data (CWE-502). This allows attackers to inject arbitrary PHP objects, potentially leading to remote code execution or other malicious operations depending on available gadget chains in the WordPress environment. The vulnerability was reported by Patchstack and affects all versions up to and including 3.7.1; no CVSS score, EPSS data, or KEV status is currently available, though the nature of object injection vulnerabilities typically permits unauthenticated exploitation.

Technical ContextAI

The vulnerability resides in the NooTheme CitiLights WordPress theme (CPE: cpe:2.3:a:nootheme:citilights:*:*:*:*:*:*:*:*) and involves unsafe PHP object serialization/deserialization, classified under CWE-502 (Deserialization of Untrusted Data). WordPress themes sometimes deserialize user-supplied data without proper validation, allowing attackers to craft malicious serialized objects that instantiate arbitrary PHP classes. When the application calls unserialize() on attacker-controlled input, it reconstructs these objects in memory. If exploitable gadget chains exist within WordPress core, loaded plugins, or the theme itself, attackers can chain object method calls (__wakeup, __destruct, __toString magic methods) to achieve code execution or information disclosure. This is a well-established pattern in WordPress security vulnerabilities and requires no authentication in most cases.

RemediationAI

Immediately upgrade NooTheme CitiLights to a patched version greater than 3.7.1 if and when the vendor releases a fix; check the Patchstack advisory and NooTheme's official repository for availability. Until a patch is available, implement input validation and sanitization at the WordPress level to block serialized object payloads in user-supplied data, disable unserialize() calls on untrusted input, and consider using alternative serialization formats (JSON). Apply the principle of least privilege to theme functions and restrict direct access to theme files via web server configuration. Monitor WordPress logs and file integrity for unexpected object instantiation or suspicious class usage. If the theme cannot be patched immediately, consider migrating to an alternative, actively maintained WordPress theme to eliminate the attack surface entirely.