CVE-2026-24971: 
WordPress vulnerability analysis and mitigation

CVE-2026-24971 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Elated-Themes "Search & Go" WordPress theme that allows unauthenticated attackers to escalate privileges. It affects all versions of the theme up to and including version 2.8, with version 2.8.1 being the patched release. The vulnerability was reported on December 14, 2025, by researcher Phat RiO and published by Patchstack on March 13, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Patchstack).

The root cause is an Incorrect Privilege Assignment (CWE-266) within the Search & Go WordPress theme, where privilege checks are improperly implemented, allowing a low-privileged or unauthenticated user to obtain elevated access. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable remotely. According to Patchstack, the vulnerability is classified under OWASP Top 10 A7 (Identification and Authentication Failures), and exploitation requires only Subscriber-level access at minimum — or potentially no account at all — to trigger the privilege escalation (Patchstack).

Successful exploitation allows an attacker to escalate from a low-privileged or unauthenticated role to a high-privileged account within the WordPress environment, potentially achieving full administrative control of the affected website. This results in complete compromise of confidentiality, integrity, and availability — attackers could exfiltrate sensitive data, modify site content, install backdoors, or pivot to other systems hosted on the same infrastructure (Patchstack).

As of the time of publication, no public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.017% (0.000170), indicating a currently low probability of exploitation in the near term. However, Patchstack notes that vulnerabilities of this severity class (CVSS 9.8) are frequently targeted in mass-exploit campaigns against WordPress sites regardless of traffic or popularity. The vulnerability has not been listed in the CISA KEV catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Elated-Themes "Search & Go" theme version ≤ 2.8 via tools like WPScan, Shodan, or by inspecting theme metadata in publicly accessible style.css files.
2. Access the vulnerable endpoint: Send a crafted network request to the target WordPress site targeting the theme's privilege assignment functionality — this may involve registering a low-privileged account (e.g., Subscriber role) or sending unauthenticated requests to a vulnerable theme action or AJAX handler.
3. Trigger privilege escalation: Exploit the incorrect privilege assignment logic by submitting a specially crafted request that bypasses role checks, causing the application to assign elevated privileges (e.g., Administrator) to the attacker-controlled account.
4. Achieve full site control: With administrative access, the attacker can install malicious plugins, create backdoor accounts, exfiltrate database contents, or deface the site (Patchstack).

• Logs: WordPress access logs showing unexpected requests to theme-specific AJAX endpoints or admin-ajax.php with unusual parameters from unauthenticated or low-privileged users; sudden role changes in WordPress user logs.
• File System: Newly created or modified PHP files in the theme directory or wp-content/uploads; presence of unauthorized plugin installations.
• WordPress Database: Unexpected changes to user roles in the wp_usermeta table (e.g., wp_capabilities set to administrator for low-privileged accounts); new administrator accounts not created by site owners.
• Network: Unusual POST requests to /wp-admin/admin-ajax.php or theme-specific endpoints from external IPs, particularly in high volume suggesting automated scanning (Patchstack).

The vendor has released version 2.8.1 of the Search & Go theme, which resolves this vulnerability — site owners should update immediately. For those unable to update immediately, Patchstack has issued a virtual patching/mitigation rule for Patchstack-protected sites to block exploitation attempts until the theme is updated. As an additional precaution, consider temporarily deactivating the theme and switching to an alternative if patching is not immediately feasible (Patchstack).

Wordfence referenced this vulnerability in their weekly WordPress vulnerability report for the period of March 9–15, 2026, highlighting it among notable disclosures. Patchstack, which coordinated the disclosure and credited researcher Phat RiO, classified it as high priority and warned that vulnerabilities of this CVSS score class are commonly used in mass-exploit campaigns targeting WordPress sites (Patchstack).