The vulnerability is a PHP Object Injection flaw caused by deserialization of untrusted data within the JobSearch plugin for WordPress. By manipulating the serialized payload that the plugin accepts, an attacker can trigger the instantiation of arbitrary objects, which may lead to remote code execution. The primary impact is complete compromise of the affected WordPress site’s confidentiality, integrity, and availability, allowing an attacker to run arbitrary code on the web server.

This flaw exists in all releases of the JobSearch plugin identified by the vendor eyecix, from the first available version up to, but not including, 3.0.8. WordPress sites that have installed any of these vulnerable plugin versions are at risk.

The CVSS score of 9.8 indicates a critical level of severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, yet the existence of an unpatched DoS or remote code execution vector warrants immediate attention. The vulnerability is not listed in the CISA KEV catalog, but attackers can infer the attack vector as a remote, web‑based payload that exploits the plugin’s deserialization logic. No specialized prerequisites are mentioned beyond the ability to transmit crafted data to the plugin’s endpoints.