What is the CVSS score of CVE-2026-24978?

CVE-2026-24978 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jobica Core are affected by CVE-2026-24978?

CVE-2026-24978 presents significant security risk, a insecure deserialization vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2026-24978?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Jobica Core CVE-2026-24978

EUVD-2026-15596 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-9244-j58g-p3v8

Deserialization Jobica Core

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15596

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.

AnalysisAI

A PHP Object Injection vulnerability exists in NooTheme Jobica Core plugin through version 1.4.1, stemming from unsafe deserialization of untrusted data. This affects WordPress installations using the vulnerable Jobica Core plugin, allowing attackers to inject malicious serialized objects that can lead to arbitrary code execution or information disclosure depending on available gadget chains. The vulnerability has been identified by Patchstack but lacks public CVSS scoring and KEV confirmation at this time.

Technical ContextAI

This vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a critical class of PHP vulnerabilities where user-controlled input is passed to unserialize() functions without proper validation. The affected product is the NooTheme Jobica Core plugin (CPE: cpe:2.3:a:nootheme:jobica_core:*:*:*:*:*:*:*:*), which appears to be a WordPress plugin for job listings. PHP object injection occurs when an attacker crafts a malicious serialized object string that, upon deserialization, instantiates gadget chain classes leading to method invocations not intended by the developer. This is particularly dangerous in WordPress environments where numerous plugins may provide exploitable gadget chains (e.g., through __wakeup, __destruct, or __toString magic methods) that can be chained together to achieve remote code execution.

RemediationAI

Immediately upgrade NooTheme Jobica Core to a patched version beyond 1.4.1 if available from the vendor; check the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/jobica-core/vulnerability/wordpress-jobica-core-plugin-1-4-1-php-object-injection-vulnerability) for the specific patched version number and download link. If no patch is immediately available, disable or remove the Jobica Core plugin from your WordPress installation until a fix is released. As a temporary mitigation, review and restrict access to any endpoints or functions that accept user input processed through unserialize(), and implement Web Application Firewall (WAF) rules to detect and block known PHP serialization gadget chain patterns. Monitor the Patchstack and NooTheme security channels for patch release notifications.