CVE-2024-24926: 
WordPress vulnerability analysis and mitigation

The UnitedThemes Brooklyn WordPress Theme contains a Deserialization of Untrusted Data vulnerability (CVE-2024-24926) affecting all versions up to and including 4.9.7.6. This vulnerability allows authenticated attackers with subscriber-level access or higher to perform PHP Object Injection (Patchstack, WPScan).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and has received a CVSS v3.1 base score of 8.8 (HIGH) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Patchstack assigned a slightly lower CVSS score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

While no POP chain is present in the vulnerable theme itself, if a POP chain exists via additional plugins or themes installed on the target system, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute code (WPScan).

Users should update to a version newer than 4.9.7.6 to resolve this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking attacks until users can update to a fixed version (Patchstack).