What is the CVSS score of CVE-2026-54186?

CVE-2026-54186 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of JobSearch WordPress Plugin are affected by CVE-2026-54186?

The eyecix JobSearch WordPress plugin versions 3.2.9 and earlier contains an unauthenticated SQL injection vulnerability enabling attackers to directly access the WordPress database and exfiltrate…

How to fix or mitigate CVE-2026-54186?

Within 24 hours: Audit all WordPress installations to identify active deployments of eyecix JobSearch plugin (versions 3.2.9 and earlier) and document which systems and databases are exposed. Within 7 days: Deactivate and completely remove the eyecix JobSearch plugin from all affected WordPress instances; review database access logs for suspicious SQL queries and unauthorized activity since plugin deployment. Within 30 days: Conduct forensic analysis of database logs to identify evidence of exploitation; evaluate alternative plugins with active vendor security support; implement Web Application Firewall rules to detect SQL injection attempts and apply least-privilege database access controls.

JobSearch WordPress Plugin CVE-2026-54186

EUVD-2026-37631 CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Jobsearch Wordpress Plugin Eyecix

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network-reachable WordPress plugin SQLi; scope changes to the database, high confidentiality loss, low integrity from potential limited writes, no availability impact typical for read-oriented SQLi.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:58 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.

AnalysisAI

Unauthenticated SQL injection in the eyecix JobSearch WordPress plugin (versions 3.2.9 and earlier) allows remote attackers to inject arbitrary SQL into backend database queries without credentials or user interaction. With a CVSS 3.1 score of 9.3 and a Scope:Changed vector indicating impact beyond the vulnerable component, the flaw enables high-confidentiality data theft from the WordPress database including user records and credentials. No public exploit identified at time of analysis, but Patchstack-tracked WordPress plugin SQLi issues are commonly weaponized shortly after disclosure.

Technical ContextAI

The affected component is the eyecix JobSearch (wp-jobsearch) plugin, a job-board WordPress plugin (CPE cpe:2.3:a:eyecix:jobsearch). CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates user-supplied input is concatenated into SQL statements without proper parameterization or escaping via wpdb->prepare(). WordPress plugins commonly mishandle GET/POST parameters in AJAX handlers (wp_ajax_nopriv_* hooks) or REST endpoints exposed without authentication, allowing attackers to manipulate WHERE clauses, ORDER BY fragments, or use UNION-based injection to extract data directly from the wp_users, wp_usermeta, and wp_options tables.

RemediationAI

No vendor-released patch version was specified in the supplied intelligence - Patchstack advisory titles the issue as affecting <=3.2.9 but a confirmed fixed release is not independently verified in the input data; administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-jobsearch/vulnerability/wordpress-jobsearch-plugin-3-2-9-sql-injection-vulnerability and upgrade to the next release above 3.2.9 once published by eyecix. As immediate compensating controls, deactivate the wp-jobsearch plugin (side effect: job board functionality offline), or place a WAF rule in front of the site to block SQL meta-characters and UNION SELECT patterns on JobSearch-specific AJAX/REST endpoints (side effect: possible false positives on legitimate search queries containing quotes). Restricting access to /wp-admin/admin-ajax.php from untrusted networks is not viable since the endpoint must serve unauthenticated visitors for job-search functionality.