EUVD-2026-15596
GHSA-9244-j58g-p3v8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.
AnalysisAI
A PHP Object Injection vulnerability exists in NooTheme Jobica Core plugin through version 1.4.1, stemming from unsafe deserialization of untrusted data. This affects WordPress installations using the vulnerable Jobica Core plugin, allowing attackers to inject malicious serialized objects that can lead to arbitrary code execution or information disclosure depending on available gadget chains. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Authenticated user account required on NooTheme Jobica Core version <= 1.4.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | While CVSS and EPSS scores are unavailable in this intelligence, the underlying vulnerability class (CWE-502) is consistently rated as critical in real-world assessments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious serialized PHP object string targeting a gadget chain available in the WordPress environment (potentially through popular plugins like WordPress core classes or complementary theme/plugin classes). The attacker submits this payload through a vulnerable endpoint in Jobica Core that deserializes untrusted input without validation. … |
| Remediation | Immediately upgrade NooTheme Jobica Core to a patched version beyond 1.4.1 if available from the vendor; check the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/jobica-core/vulnerability/wordpress-jobica-core-plugin-1-4-1-php-object-injection-vulnerability) for the specific patched version number and download link. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 7 days: Identify all affected systems and apply vendor patches promptly. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today