Quick answers
- Is CVE-2026-84834 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84834 being exploited in the wild.
- How severe is CVE-2026-84834?
- Critical severity, with a CVSS score of 9.8, published 3 September 2026.
- Which products and versions are affected?
- EyeCix Technologies JobSearch 3.2.0 and earlier.
- Is there a fix for CVE-2026-84834?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-84834 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-84834?
- Check whether you run EyeCix Technologies JobSearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a PHP object injection flaw in the JobSearch WordPress plugin affecting versions 3.2.0 and earlier. It allows unauthenticated attackers to inject and deserialize malicious PHP objects, which can be leveraged to achieve remote code execution on the server. The attack requires only network access to the vulnerable plugin endpoint—no authentication or user interaction is needed. A successful exploit grants an attacker full control over the WordPress installation and underlying server. As of the advisory date, no official patch was available; mitigation via a WAF rule or plugin update to a version beyond 3.2.0 is recommended.
Affected products
- EyeCix Technologies JobSearch 3.2.0 and earlier
Timeline
- 2026-09-03: disclosed: Published by Patchstack
- 2026-01-14: other: Reported by Phat RiO