CVE-2024-24926

HIGH

UnitedThemes Brooklyn <4.9.7.6 - Deserialization

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-24926. PoCs published by moften.

AI-analyzed exploit summary The repository provides a description of CVE-2024-24926, a deserialization vulnerability in the WordPress Brooklyn theme (versions up to 4.9.7.6). It includes a PHP code snippet demonstrating how to serialize a malicious object, but lacks a full exploit or proof-of-concept for execution.

Description

Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6.

Exploits (1)

nomisec WRITEUP
by moften · poc
https://github.com/moften/CVE-2024-24926

The repository provides a description of CVE-2024-24926, a deserialization vulnerability in the WordPress Brooklyn theme (versions up to 4.9.7.6). It includes a PHP code snippet demonstrating how to serialize a malicious object, but lacks a full exploit or proof-of-concept for execution.

Classification
Writeup 80%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Theoretical
Target: WordPress Brooklyn theme <= 4.9.7.6
No auth needed
Prerequisites: Access to a vulnerable WordPress instance with the Brooklyn theme installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0109
EPSS Percentile 61.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-502
Status published
Products (2)
unitedthemes/brooklyn < 4.9.7.6
UnitedThemes/Brooklyn | Creative Multi-Purpose Responsive WordPress Theme < 4.9.7.6
Published Feb 12, 2024
Tracked Since Feb 18, 2026