JobSearch WordPress Plugin EUVD-2026-37495

Required conditions: a WordPress site running the eyecix JobSearch (wp-jobsearch) plugin at version 3.2.7 or earlier with the vulnerable endpoint reachable over HTTP/HTTPS - the CVSS vector PR:N and UI:N confirm no authentication and no user interaction are needed, and AC:L confirms no special timing, race, or environmental condition is required. Limiting factors are narrow: the site must actually have the JobSearch plugin installed and active (a niche commercial plugin, not bundled with WordPress core), and the targeted instance must expose the affected endpoint over the network rather than behind authentication-required reverse proxies or IP allow-lists. No specific deployment mode or non-default configuration is implied by the description.

Signals are mixed and important to disentangle. CVSS 3.1 base score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N signals trivial remote, unauthenticated exploitation impacting only confidentiality - consistent with mass scrape of protected data rather than takeover. The vulnerability is NOT on the CISA KEV list and no public exploit identified at time of analysis; EPSS data was not provided so probability of exploitation cannot be quantified. Patchstack's tagging as 'Authentication Bypass' and the Broken Access Control framing strongly imply automatable enumeration against any internet-exposed WordPress site running the plugin, which raises real-world urgency despite the absence of an integrity/availability impact. The single reference is the Patchstack advisory itself - there is no NVD enrichment, vendor advisory, or independent confirmation of the exact affected endpoint, so the precise data exposed is not corroborated.

An attacker scans the internet for WordPress sites running wp-jobsearch ≤3.2.7 (fingerprintable via plugin assets and readme.txt), then issues unauthenticated HTTP requests to the vulnerable AJAX or REST endpoint to retrieve data the plugin should restrict to logged-in employers or admins, such as applicant records, contact details, or private listing metadata. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the request is a simple one-shot call with no chaining required, making the operation easily scriptable against many sites. No public exploit identified at time of analysis, but the bug class is straightforward to weaponize once the specific endpoint is disclosed.