EUVD-2026-15767
GHSA-f39p-p4f3-mvp5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2.
AnalysisAI
Unauthenticated attackers can bypass authentication controls in NooTheme Jobica Core through an alternate access path, affecting versions up to 1.4.2. This critical vulnerability (CVSS 9.8) enables attackers to gain unauthorized access without credentials or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote unauthenticated attacker can exploit NooTheme Jobica Core versions through 1.4.2 via an alternate authentication path or channel. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Without published CVSS scores, EPSS percentiles, or KEV status, this vulnerability's real-world priority must be assessed through available signals: it is confirmed by a reputable security researcher (Patchstack) with a published advisory, affects a WordPress plugin with unknown but potentially significant user base, and directly enables account takeover (technical impact: confidentiality, integrity, and availability compromise). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers the alternate authentication path exposed by Jobica Core (such as a poorly secured REST endpoint or plugin-specific login handler) and crafts requests that bypass the standard WordPress authentication validation. By directly calling this alternate channel without proper credential verification, the attacker gains access to another user's account—potentially an administrator account—without knowing the correct password. … |
| Remediation | Immediately upgrade NooTheme Jobica Core to a version after 1.4.2 (verify the latest patched version via the Patchstack advisory and the plugin's official repository). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all affected systems and apply vendor patches immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today