External risk intelligence

JobSearch Unauthenticated PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-84834

The vulnerability affects a WordPress plugin, which is a type of web application component commonly deployed as a public-facing website. Since it handles user interactions and requests, it is frequently reachable over the public internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in a PHP-based job search component allows unauthenticated attackers to inject malicious code, potentially leading to complete system compromise. This issue affects software versions up to 3.2.0. The main concern is confirming relevance and exposure due to the potential for severe impact.

Unauthenticated code injection in job search software.
Critical flaw could allow full system takeover.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

This vulnerability allows an unauthenticated attacker to inject malicious PHP objects into the JobSearch component of a website. Because the application processes these objects without proper validation, an attacker could potentially execute arbitrary code on the server, leading to a complete compromise of the site.

Entry condition: None required.
Trigger point: Unsanitized user input to the JobSearch component.
Resulting risk: Arbitrary code execution and site compromise.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated PHP Object Injection in JobSearch could allow an attacker to execute arbitrary code or overwrite sensitive files on the server when the application processes specifically crafted, serialized data. This may lead to a complete compromise of the application and its underlying system.

Sensitive files and arbitrary code execution.
Via unauthenticated network requests.
Application compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP Object Injection vulnerability impacts the JobSearch plugin, likely managed by application owners or the platform team responsible for the WordPress environment. The first practical step is to identify all instances of the JobSearch plugin, confirm their reachability and business criticality, and then assign ownership for remediation planning.

Application owners should own the remediation.
Verify plugin reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the JobSearch plugin?

JobSearch is a WordPress plugin designed to add recruitment and vacancy management functionality to websites. It allows site owners to create job boards where employers can post openings and candidates can search or apply for roles. Because it serves as a functional component within a WordPress environment, it handles various data inputs and user interactions necessary for managing these job listings.

What does PHP Object Injection mean for CVE-2026-84834?

This vulnerability, classified as CWE-502, occurs when an application improperly trusts serialized data provided by users. In the context of this CVE, the plugin accepts this data without sufficient validation. An attacker can craft specific objects that, when processed by the server, force the application to perform unintended actions, which can ultimately lead to the execution of arbitrary code on the underlying system.

How is this vulnerability triggered by an attacker?

An attacker triggers this flaw by sending a network request containing malicious, serialized PHP objects to the JobSearch component. Because the vulnerability requires no authentication, the attacker does not need to log in or have existing privileges on the site. Normal interactions with the site that do not involve submitting specially crafted serialized data will not trigger the vulnerability.

Do I need to worry if my JobSearch instance is internal?

Halo Surface Signal indicates that because this plugin is a web component typically deployed on public-facing websites, it is frequently reachable over the internet. While internal-only instances face a lower risk profile compared to those exposed to the public, any system reachable by untrusted parties on your network remains a target. You should prioritize assets that are accessible via the public internet.

When should I start responding to this CVE?

You should begin by auditing your environment to identify every instance where the JobSearch plugin is installed and active. Determine the business criticality of these sites and confirm their reachability. Once you have a clear inventory, assign ownership to the relevant platform or application teams so they can prepare to apply the necessary updates or mitigate the risk to your infrastructure.

References

patchstack.com/database/wordpress/plugin/wp-jobsearch/vulnerability/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.