CVE-2026-84834

CVE-2026-84834 is an unauthenticated PHP object injection flaw (CWE-502) in the JobSearch job-board plugin for WordPress. An attacker with no account or privileges can submit crafted serialized PHP data to an affected plugin parameter or endpoint, which the plugin unserializes without validation. Successful injection can, depending on available gadget chains in the plugin and WordPress environment, lead to code execution, data manipulation, or other site compromise; the assigned CVSS 3.1 score of 9.8 reflects potentially high impact on confidentiality, integrity, and availability. Any WordPress site running JobSearch version 3.2.0 or earlier is affected. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS estimates only about a 0.3% chance of exploitation in the next 30 days.

What to do: Update the JobSearch plugin to the latest release available from the developer, i.e., any version newer than 3.2.0. As an interim mitigation, apply WAF rules blocking untrusted serialized PHP input to plugin parameters and review logs for anomalous serialized payloads. Because no public PoC exists, prioritize patching internet-facing job-board sites where anonymous access is enabled.