The vulnerability CVE-2026-24954 affects the magepeopleteam WpEvently WordPress plugin up to version 5.0.8. It involves deserialization of untrusted data, which can lead to object injection attacks. This type of vulnerability allows an attacker with at least low privileges to execute arbitrary code or manipulate application logic, potentially resulting in full system compromise. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the available data.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system's confidentiality, integrity, and availability. An attacker could execute arbitrary code or manipulate application behavior via object injection through deserialization of untrusted data. This poses a significant risk to systems running vulnerable versions of the WpEvently plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and limit user privileges to reduce risk. Monitor for updates from magepeopleteam regarding patches or mitigations.