EUVD-2026-15588
GHSA-vqjh-xqjg-g4p7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.
AnalysisAI
A PHP Object Injection vulnerability exists in NooTheme CitiLights WordPress theme through version 3.7.1, stemming from unsafe deserialization of untrusted data (CWE-502). This allows attackers to inject arbitrary PHP objects, potentially leading to remote code execution or other malicious operations depending on available gadget chains in the WordPress environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authenticated user access (PR:L) to NooTheme CitiLights WordPress plugin version 3.7.1 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | While no CVSS vector or EPSS score is provided, the underlying vulnerability class (CWE-502 object injection) is universally considered critical in WordPress contexts because exploitation typically requires only network access and no authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious serialized PHP object and injects it into a parameter handled by CitiLights (e.g., via a POST request, URL parameter, or form field). When the theme's code deserializes this object without validation, the attacker's injected object is instantiated, triggering magic methods like __wakeup or __destruct. … |
| Remediation | Immediately upgrade NooTheme CitiLights to a patched version greater than 3.7.1 if and when the vendor releases a fix; check the Patchstack advisory and NooTheme's official repository for availability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 7 days: Identify all affected systems and apply vendor patches promptly. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today