What is the CVSS score of CVE-2026-27049?

CVE-2026-27049 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jobica Core are affected by CVE-2026-27049?

CVE-2026-27049 presents critical security risk rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.

How to fix or mitigate CVE-2026-27049?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Jobica Core CVE-2026-27049

EUVD-2026-15767 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-03-25 Patchstack

GHSA-f39p-p4f3-mvp5

Authentication Bypass Jobica Core

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15767

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2.

AnalysisAI

Unauthenticated attackers can bypass authentication controls in NooTheme Jobica Core through an alternate access path, affecting versions up to 1.4.2. This critical vulnerability (CVSS 9.8) enables attackers to gain unauthorized access without credentials or user interaction. No patch is currently available.

Technical ContextAI

The vulnerability resides in the NooTheme Jobica Core WordPress plugin (cpe:2.3:a:nootheme:jobica_core), which likely provides job listing and recruitment functionality. The root cause is classified under CWE-288, indicating a flaw in how the plugin implements authentication validation. Rather than a single authentication mechanism, the plugin appears to expose multiple authentication paths or channels, and the security implementation fails to properly validate credentials across all of these paths. This common architectural weakness allows attackers to bypass primary authentication controls by leveraging inadequately secured alternative authentication vectors, potentially including REST API endpoints, legacy authentication handlers, or plugin-specific authentication hooks that lack the same validation rigor as the main authentication flow.

RemediationAI

Immediately upgrade NooTheme Jobica Core to a version after 1.4.2 (verify the latest patched version via the Patchstack advisory and the plugin's official repository). Administrators should access their WordPress plugin management dashboard, locate Jobica Core, and update to the latest available version. Until patching can be completed in production environments, implement compensating controls: restrict direct access to the WordPress admin panel via IP whitelisting or WAF rules, disable REST API endpoints if not required for Jobica Core functionality, enforce strong password policies for all user accounts, enable multi-factor authentication where supported, and audit user access logs for suspicious authentication patterns. Additionally, review and audit any custom authentication implementations or third-party integrations with Jobica Core that may expose alternative authentication paths. See the Patchstack advisory for vendor guidance and patch availability confirmation.