JobSearch WordPress Plugin CVE-2026-54186

The wp-jobsearch plugin must be installed and active on a target WordPress site, version 3.2.9 or earlier, with the vulnerable JobSearch endpoint reachable from the internet (default WordPress deployment exposes admin-ajax.php and REST routes to unauthenticated visitors). No authentication, no user interaction, and no special configuration are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation against default configurations of the plugin. The only limiting factor is that the specific vulnerable parameter/endpoint within JobSearch has not been disclosed in the public input data, so a determined attacker would need to identify it from the patched code diff or the Patchstack advisory body.

This is a high-priority vulnerability based on multiple converging signals. The CVSS vector AV:N/AC:L/PR:N/UI:N is the worst-case exposure profile - remotely reachable, low complexity, no authentication, no user interaction - and the Scope:Changed flag elevates the score to 9.3 by reflecting impact on resources beyond the plugin itself (the underlying database). Confidentiality is High while Integrity is None and Availability is Low, consistent with a read-oriented SQLi (data exfiltration) rather than write/DROP capability. EPSS and CISA KEV data were not supplied in the input, so real-world exploitation frequency cannot be quantified, but Patchstack disclosure of an unauthenticated SQLi in a public-facing WordPress plugin historically correlates with rapid mass-scanning by botnets. Note: the CVSS vector lists I:N, yet SQLi often allows writes - verify with vendor whether the injection point is read-only.

An unauthenticated attacker enumerates WordPress sites running the JobSearch plugin via fingerprinting (e.g., /wp-content/plugins/wp-jobsearch/ paths) and sends a crafted HTTP request to a vulnerable JobSearch AJAX or REST endpoint with malicious SQL payload in a query parameter. The injection executes against the WordPress database, allowing the attacker to extract administrator password hashes from wp_users and session tokens or API keys from wp_usermeta and wp_options, which can be cracked or replayed to escalate to full site control.