# CVE-2026-84834: WordPress JobSearch plugin PHP object injection

Source: https://junglewise.ai/threats/cve-2026-84834-wordpress-jobsearch-plugin-php-object-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84834 · Severity: critical · CVSS 9.8 · Published 2026-09-03

JobSearch is a popular WordPress plugin for job listing and recruitment functionality. An unauthenticated PHP object injection vulnerability allows attackers to manipulate server-side data processing and execute arbitrary code without requiring a login or special access, potentially leading to complete site compromise and data theft.

Technologies: [EyeCix Technologies JobSearch](https://junglewise.ai/threats/technologies/jobsearch). Vendors: [EyeCix Technologies](https://junglewise.ai/threats/vendors/eyecix-technologies).

## Quick answers

**Is CVE-2026-84834 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84834 being exploited in the wild.

**How severe is CVE-2026-84834?** Critical severity, with a CVSS score of 9.8, published 3 September 2026.

**Which products and versions are affected?** EyeCix Technologies JobSearch 3.2.0 and earlier.

**Is there a fix for CVE-2026-84834?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84834 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84834?** Check whether you run EyeCix Technologies JobSearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a PHP object injection flaw in the JobSearch WordPress plugin affecting versions 3.2.0 and earlier. It allows unauthenticated attackers to inject and deserialize malicious PHP objects, which can be leveraged to achieve remote code execution on the server. The attack requires only network access to the vulnerable plugin endpoint—no authentication or user interaction is needed. A successful exploit grants an attacker full control over the WordPress installation and underlying server. As of the advisory date, no official patch was available; mitigation via a WAF rule or plugin update to a version beyond 3.2.0 is recommended.

## Affected products

- EyeCix Technologies JobSearch 3.2.0 and earlier

## Timeline

- 2026-09-03: disclosed: Published by Patchstack
- 2026-01-14: other: Reported by Phat RiO

## References

- [https://patchstack.com/database/wordpress/plugin/wp-jobsearch/vulnerability/wordpress-jobsearch-plugin-3-2-0-php-object-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp-jobsearch/vulnerability/wordpress-jobsearch-plugin-3-2-0-php-object-injection-vulnerability?_s_id=cve)

## Related threats

- [EyeCix JobSearch unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-54186-eyecix-jobsearch-unauthenticated-sql-injection)
- [EyeCix Technologies JobSearch broken access control](https://junglewise.ai/threats/cve-2026-49057-eyecix-technologies-jobsearch-broken-access-control)