Description

Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-03T17:17:29.400Z",
  "pubdate": "2026-09-03T17:17:29.400Z",
  "executiveSummary": "The JobSearch plugin for WordPress, specifically in versions 3.2.0 and below, contains a critical vulnerability categorized as PHP Object Injection.\nThis security flaw arises from the insecure deserialization of user-supplied input, allowing unauthenticated remote attackers to inject malicious serialized objects into the application.\nSuccessful exploitation of this vulnerability enables attackers to achieve Remote Code Execution (RCE), bypass authentication mechanisms, or perform unauthorized file operations, depending on the available POP (Property-Oriented Programming) chains present in the environment.\nThe vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected WordPress site.\nBecause the vulnerability is exploitable without authentication, it allows for widespread abuse by remote threat actors targeting the application's underlying server environment.\nOrganizations utilizing JobSearch versions 3.2.0 or lower are highly susceptible to total system compromise if an attacker identifies suitable classes within the application or its dependencies that can be leveraged to execute arbitrary PHP code during the deserialization process.",
  "technicalDetails": "The root cause of this vulnerability is the use of the unserialize() PHP function on unsanitized user-provided input within the JobSearch plugin.\nPHP Object Injection occurs when an application deserializes untrusted data without sufficient validation. This process allows an attacker to manipulate the state of existing objects or instantiate new objects of arbitrary classes available in the application scope.\nIn the context of JobSearch <= 3.2.0, the plugin fails to implement adequate input filtering or signing mechanisms before passing incoming data to the unserialize() function.\nThe attack flow commences with the adversary identifying an entry point within the plugin that accepts serialized data via HTTP parameters, headers, or cookies. By crafting a malicious serialized string, the attacker defines the structure and property values of an object that will be instantiated upon deserialization.\nExploitation relies on the presence of 'magic methods' (such as __wakeup(), __destruct(), or __toString()) within the application codebase or its bundled libraries. These magic methods are invoked automatically during or after the deserialization process. An attacker leverages these methods to chain together different 'gadgets'—existing code segments within the application—to form a POP chain.\nBy manipulating the object's properties, the attacker directs the execution flow of these magic methods to perform unintended actions. For example, if a gadget exists that facilitates file deletion, the attacker can supply an object that triggers this method against sensitive system files. If a gadget allows for arbitrary code execution, the attacker can gain a remote shell or execute system-level commands with the privileges of the web server user.\nSince this vulnerability is reachable without authentication, it requires no prior access or privilege escalation to initiate, making it a critical vector for automated exploitation attempts in the wild.\nThe post-exploitation impact includes full site takeover, unauthorized database access, the installation of persistent backdoors, and potential lateral movement into the hosting infrastructure."
}