CVE-2026-24954
Deserialization Object Injection in WpEvently
Publication date: 2026-02-03
Last updated on: 2026-02-03
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| magepeople | wp_evently | to 5.0.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24954 is a vulnerability in the WordPress WpEvently plugin (versions up to and including 5.0.8) that involves deserialization of untrusted data, which is a type of object injection flaw.
This means that an attacker can manipulate the data being deserialized by the plugin, potentially allowing them to execute arbitrary code or disrupt the normal operation of the website.
The vulnerability is classified under OWASP Top 10 A3: Injection.
How can this vulnerability impact me? :
An attacker with contributor or developer privileges could exploit this vulnerability to execute commands on the affected website and gain access to the admin panel.
This could lead to denial of service or unauthorized control over the website.
However, despite a high CVSS score of 8.8, the vulnerability is considered low priority with low severity impact and is unlikely to be widely exploited.
Users are advised to update the plugin to version 5.0.9 or later to mitigate the risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'The vulnerability affects WordPress sites using the WpEvently plugin version 5.0.8 or earlier. Detection involves checking the installed plugin version to see if it is vulnerable.'}, {'type': 'list_item', 'content': 'Use the WordPress admin dashboard to verify the WpEvently plugin version.'}, {'type': 'list_item', 'content': "From the command line, you can check the plugin version by navigating to the WordPress plugins directory and inspecting the plugin's main file, for example:"}, {'type': 'list_item', 'content': "grep 'Version' wp-content/plugins/mage-eventpress/mage-eventpress.php"}, {'type': 'paragraph', 'content': 'There are no specific network detection commands or signatures provided for this vulnerability.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update the WpEvently plugin to version 5.0.9 or later, where the vulnerability has been fixed.
Additionally, limiting contributor or developer privileges can reduce the risk of exploitation.
Using automated update tools such as Patchstack can help rapidly protect vulnerable plugins.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-24954 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.