What is the CVSS score of CVE-2025-62025?

CVE-2025-62025 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of eyecix JobSearch are affected by CVE-2025-62025?

The eyecix JobSearch plugin for WordPress - a component used on every release below 3.0.8 - carries a critical unauthenticated PHP object injection flaw that lets an external attacker submit crafted…

How to fix or mitigate CVE-2025-62025?

Within 24 hours, inventory every WordPress instance running the eyecix JobSearch plugin and confirm which sites are on versions below 3.0.8; where the plugin is not business-essential, deactivate and remove it immediately, and where it is required, apply the vendor-released patch by upgrading to 3.0.8 or later at the earliest available change window. Within 7 days, complete the 3.0.8 upgrade across all remaining production and staging sites, verify the installed version through the WordPress admin or WP-CLI, add virtual patching or WAF rules that block serialized payloads directed at the plugin's endpoints, and review web and application logs for suspicious POST requests or unexpected file, user, or option changes since exposure began. Within 30 days, fold WordPress plugin patch currency into routine vulnerability management with automated version reporting, restrict administrative access to the affected sites, and schedule a follow-up scan to confirm no instance remains below 3.0.8 and that no indicators of compromise persist.

eyecix JobSearch CVE-2025-62025

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Plugin

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N/UI:N) per the advisory, but PHP object injection depends on an available POP gadget chain, so AC:H; full impact if exploited.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:22 vuln.today

CVE Published

Oct 22, 2025 - 15:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8.

AnalysisAI

PHP object injection (untrusted deserialization) in the eyecix JobSearch WordPress plugin affects every release below 3.0.8, allowing a remote attacker to pass crafted serialized data into the plugin's deserialization path. Per the assigned CVSS vector no authentication (PR:N) or user interaction (UI:N) is required, so exploitation is network-reachable against any site running an affected version; however, the independent assessment rates attack complexity as High (AC:H) because a working POP/gadget chain must exist in the plugin or its WordPress environment, and the very low EPSS of 0.58% (46th percentile) reflects that practical weaponization is not trivial despite the 9.8 severity headline. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor-published fix is version 3.0.8.

Technical ContextAI

The root cause is CWE-502, Deserialization of Untrusted Data, implemented in the WordPress plugin eyecix JobSearch (slug wp-jobsearch). The plugin passes attacker-influenced input into PHP's unserialize() (or an equivalent object-hydration routine) instead of safe formats such as JSON, letting an attacker control the class names and property values that PHP instantiates. The impact is decided not by the injected bytes alone but by the availability of a Property-Oriented Programming (POP) gadget chain: a sequence of classes whose magic methods (__wakeup, __destruct, __toString, __call) chain together to reach a dangerous sink such as file write, file delete, or code execution. WordPress' large plugin/theme ecosystem frequently supplies such chains (often via libraries like Guzzle, Monolog, or Symfony components bundled in other plugins), which is why CWE-502 in WordPress components is typically treated as high-impact when a reachable gadget set exists. No CPE strings were supplied with this record, so affected scope is defined by the plugin slug and version rather than a structured CPE entry. The Patchstack advisory (referenced via NVD) documents the issue as a PHP Object Injection vulnerability fixed in 3.0.8, and the independent assessment raises attack complexity to High relative to the vendor's AC:L rating precisely because gadget availability is the gating factor on real-world impact.

Affected ProductsAI

The affected product is the eyecix JobSearch WordPress plugin, distributed under the slug wp-jobsearch, in all versions from n/a through below 3.0.8 - meaning every release up to and including 3.0.7 is vulnerable, and the fix is present starting at 3.0.8. The plugin is a third-party WordPress component, so exposure is limited to WordPress installations where JobSearch (wp-jobsearch) is installed and active and the vulnerable deserialization endpoint is reachable. No CPE identifiers were provided in the source data, so version-based identification must rely on the plugin slug and installed version reported by the site's plugin inventory. The vendor advisory is published through Patchstack at https://patchstack.com/database/Wordpress/Plugin/wp-jobsearch/vulnerability/wordpress-jobsearch-plugin-3-0-8-php-object-injection-vulnerability?_s_id=cve.

RemediationAI

Upgrade the eyecix JobSearch plugin to version 3.0.8 or later - this is the vendor-released fix per the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wp-jobsearch/vulnerability/wordpress-jobsearch-plugin-3-0-8-php-object-injection-vulnerability?_s_id=cve). On managed WordPress hosts, push the update through the dashboard or WP-CLI (wp plugin update wp-jobsearch) and verify the installed version afterwards. If immediate patching is not possible, the most effective compensating control is to deactivate the JobSearch plugin entirely until it can be updated, with the obvious trade-off of losing job-board functionality. Where the plugin must stay live, restrict network access to the plugin's job-search endpoints (for example, block unauthenticated POST/PUT requests carrying serialized payloads or O: class strings at the WAF/reverse-proxy layer) and apply virtual patching rules from your WAF vendor; note that WAF rules for PHP object injection are signature-based and can be bypassed by encoding or property-spraying variations, so they are a stopgap rather than a fix. Also inventory other plugins and themes for known POP gadget chains, since the practical severity of this flaw depends on whether a reachable chain exists in the surrounding environment - removing or updating gadget-bearing components materially reduces residual risk. Note that no vendor-released patch is lacking here; remediation is available, and given the unauthenticated network vector (PR:N/UI:N) patching should be prioritized on any internet-facing WordPress site running an affected version.