What is the CVSS score of CVE-2026-24976?

CVE-2026-24976 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Organici Library are affected by CVE-2026-24976?

CVE-2026-24976 presents significant security risk, a insecure deserialization vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2026-24976?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Organici Library CVE-2026-24976

EUVD-2026-15592 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-85xp-wwwc-66g8

Deserialization Organici Library

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15592

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2.

AnalysisAI

A PHP Object Injection vulnerability exists in NooTheme's Organici Library plugin through version 2.1.2, stemming from unsafe deserialization of untrusted data. This vulnerability allows attackers to inject arbitrary PHP objects into the application, potentially leading to remote code execution or other malicious actions depending on available gadget chains in the WordPress environment. No active exploitation in the wild (KEV status) or published proof-of-concept has been confirmed from available sources, but the vulnerability was reported by Patchstack and assigned EUVD-2026-15592, indicating it is tracked in official vulnerability databases.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a critical weakness in PHP applications where user-controlled input is passed to unserialize() or similar deserialization functions without proper validation. The NooTheme Organici Library (CPE: cpe:2.3:a:nootheme:organici_library:*:*:*:*:*:*:*:*) is a WordPress plugin that implements unsafe object deserialization, allowing an attacker to instantiate arbitrary classes available in the WordPress environment. If gadget chains exist within WordPress core or installed plugins, this can escalate to arbitrary code execution. The vulnerability affects the library across all documented versions up to and including 2.1.2, with no clear indication of which functions or entry points are exploitable.

RemediationAI

Immediately upgrade the NooTheme Organici Library plugin to a version newer than 2.1.2 if available from the vendor; check the official Patchstack advisory and NooTheme's plugin repository for patched releases. If no patched version is available, consider disabling or removing the plugin entirely until a security update is published. As a temporary mitigation while awaiting patches, restrict access to WordPress administrative functions and the plugin's entry points using Web Application Firewall (WAF) rules, limit plugin functionality through security plugins that monitor object deserialization patterns, and ensure all other WordPress plugins and core are kept up to date to minimize available gadget chains. Monitor Patchstack and the ENISA vulnerability database for vendor security advisories regarding this CVE-2026-24976 issue.