JobSearch CVE-2026-84834

Exploitation requires reaching a JobSearch (wp-jobsearch) endpoint that deserializes attacker-supplied input on a site running plugin version 3.2.0 or earlier; per CVSS AV:N/AC:L/PR:N/UI:N no authentication or user interaction is needed against a default install. The key limiting factor is the availability of a usable PHP POP gadget chain in the deployed WordPress stack (plugin, core, or other plugins) - full C:H/I:H/A:H impact (including code execution) is realized only when such a chain exists; without one, object injection may cause limited or no direct harm.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) reflects a worst-case where a reachable gadget chain yields full compromise; the unauthenticated network vector and low complexity make it broadly reachable, which is why a mid-sized municipal IT team running this plugin should treat it as urgent rather than deferring it. However, the real-world impact of any PHP Object Injection hinges on whether a usable POP chain exists in the deployed stack - if none is reachable, practical impact may be lower than the 9.8 suggests, so C/I/A:H is best read as a ceiling. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input; the absence of a public exploit does not lower the underlying severity but does argue against imminent mass exploitation. Given that Patchstack (a specialist WordPress security vendor) reported it, the finding is credible, and unauthenticated deserialization in a plugin is a well-understood, high-priority bug class that should be patched promptly.

An unauthenticated attacker sends a crafted HTTP request to a JobSearch endpoint with a serialized PHP object payload in a parameter that the plugin passes to unserialize(). If a POP gadget chain is present in the site's PHP code, the injected object's magic methods execute during deserialization, letting the attacker write or delete files, tamper with the database, or run code. No public POC is available in the provided data, but the low-complexity unauthenticated vector makes weaponization straightforward if a gadget chain is found.