CVE-2024-24926: 
WordPress vulnerability analysis and mitigation

The UnitedThemes Brooklyn WordPress Theme contains a Deserialization of Untrusted Data vulnerability (CVE-2024-24926) affecting all versions up to and including 4.9.7.6. This vulnerability allows authenticated attackers with subscriber-level access or higher to perform PHP Object Injection (Patchstack, WPScan).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and has received a CVSS v3.1 base score of 8.8 (HIGH) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Patchstack assigned a slightly lower CVSS score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

While no POP chain is present in the vulnerable theme itself, if a POP chain exists via additional plugins or themes installed on the target system, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute code (WPScan).

The vulnerability requires authentication with at least subscriber-level access. The attack vector is network-accessible and requires low complexity to exploit according to the NVD assessment (NVD).

Users should update to a version newer than 4.9.7.6 to resolve this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking attacks until users can update to a fixed version (Patchstack).