CVE-2026-84834: WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or any existing privileges to attempt exploitation.

WordPress sites using the JobSearch plugin at version 3.2.0 or earlier are affected according to the available information.

The supplied severity vector indicates network-based exploitation with low attack complexity and no user interaction required.

Published Sep 3, 2026

Updated

Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.

Affected Software

1 affected component

WordPress JobSearch<=3.2.0

Sep 3, 2026

CVE Published

via MITRE·04:31 PM

Data Sourced

via MITRE·04:31 PM

DescriptionSeverityWeakness

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or any existing privileges to attempt exploitation.

WordPress sites using the JobSearch plugin at version 3.2.0 or earlier are affected according to the available information.

The supplied severity vector indicates network-based exploitation with low attack complexity and no user interaction required.