External risk intelligence

JobSearch Plugin Deserialization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-62025

The vulnerability affects a WordPress plugin designed for job search functionality. WordPress plugins of this type are commonly deployed as public-facing web applications to enable user interaction and job board accessibility over the internet, making the vulnerable code path regularly reachable by external, unauthenticated users.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the eyecix JobSearch WordPress plugin, specifically related to the deserialization of untrusted data. This flaw allows for potential remote code execution, meaning an attacker could execute commands on the server without prior authentication. The primary concern is to confirm if this plugin is in use and if it is running an unpatched version, as this could expose the organization's systems.

Untrusted data can be used to run commands.
Plugin popularity means broad potential impact.
Confirm usage and version; address if exposed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to a vulnerable web application. This could allow them to execute arbitrary code on the server, potentially leading to complete system compromise.

Requires unauthenticated network access.
Triggered by deserializing untrusted data.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the server by sending specially crafted data to the JobSearch plugin. This could lead to a complete compromise of the affected website and its underlying infrastructure.

Server-side code execution.
Sending malicious serialized data.
Complete website compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The eyecix JobSearch plugin for WordPress is affected by a critical deserialization vulnerability. Application owners and platform teams responsible for WordPress deployments should prioritize identifying all instances of this plugin, especially those exposed to the internet. Once confirmed, an ownership review is necessary to assign remediation responsibilities, followed by a risk-based plan for patching or mitigation.

Application owners should take ownership.
Verify plugin reachability and business criticality.
Plan vendor coordination for remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the eyecix JobSearch plugin?

It is a WordPress plugin designed to add job board capabilities to a website, allowing site owners to manage job listings, employer profiles, and candidate applications directly within their WordPress environment.

What does deserialization of untrusted data mean in CVE-2025-62025?

This flaw, classified as CWE-502, occurs when the software takes user-provided data and reconstructs it into an object without proper validation. An attacker can craft this data to manipulate the application's logic, potentially running unauthorized commands on the underlying server.

How is this JobSearch vulnerability triggered?

The vulnerability is triggered when the plugin processes specially crafted input sent by an attacker. It does not require any prior authentication or user interaction to succeed, but the bug is only active if the application is running an unpatched version of the plugin prior to 3.0.8.

Why does Halo Surface Signal categorize this as an external risk?

Because the JobSearch plugin is typically deployed on public-facing WordPress sites to facilitate internet-based interactions, the vulnerable code path is regularly accessible to external, unauthenticated users over the network.

What should I do if I am running the JobSearch plugin?

Start by identifying all instances of the plugin within your infrastructure. Confirm the version currently in use and prioritize updates to version 3.0.8 or later to resolve the deserialization flaw. If you cannot update immediately, consider restricting access to the affected site features.

References

patchstack.com/database/Wordpress/Plugin/wp-jobsearch/vulnerability/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.