What is the CVSS score of CVE-2026-24981?

CVE-2026-24981 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Visionary Core are affected by CVE-2026-24981?

CVE-2026-24981 presents significant security risk, a insecure deserialization vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2026-24981?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Visionary Core CVE-2026-24981

EUVD-2026-15602 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-mc4p-6c88-mv7c

Deserialization Visionary Core

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15602

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.

AnalysisAI

A PHP Object Injection vulnerability exists in NooTheme Visionary Core plugin versions up to and including 1.4.9, stemming from unsafe deserialization of untrusted data. An attacker can inject malicious serialized objects to achieve arbitrary code execution or other critical impacts depending on available magic methods in the WordPress environment. No CVSS score, EPSS data, or KEV confirmation is currently available; however, the vulnerability is documented by Patchstack and assigned ENISA EUVD ID EUVD-2026-15602.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a critical weakness that occurs when applications deserialize user-controlled input without proper validation. The NooTheme Visionary Core plugin (identified via CPE cpe:2.3:a:nootheme:visionary_core:*:*:*:*:*:*:*:*) processes serialized PHP objects without sanitization, allowing attackers to craft malicious payloads that instantiate arbitrary classes. This exploit leverages PHP magic methods such as __wakeup(), __destruct(), or __toString() to trigger unintended code execution during the deserialization process. The vulnerability affects the WordPress ecosystem, where many plugins use serialization for configuration and cache storage.

RemediationAI

Update NooTheme Visionary Core to a patched version greater than 1.4.9 immediately if available from the vendor; check the official NooTheme website or WordPress plugin repository for the latest release. If a patch is not yet available, disable the Visionary Core plugin entirely until remediation is released, or restrict its functionality by disabling any features that process user input or accept serialized data. As an interim mitigation, implement WordPress security hardening measures including limiting plugin permissions, employing Web Application Firewalls (WAF) rules to detect suspicious serialization patterns, and monitoring plugin activity logs for evidence of exploitation. Review the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/noo-visionary-core/vulnerability/wordpress-visionary-core-plugin-1-4-9-php-object-injection-vulnerability) for vendor patching timelines and official guidance.