CVE-2026-49057: JobSearch Auth Bypass Vulnerability

CVE-2026-49057 Overview

CVE-2026-49057 is a broken access control vulnerability affecting the WordPress JobSearch plugin in versions up to and including 3.2.7. The flaw allows unauthenticated attackers to access functionality that should require authorization checks. The weakness is classified as Missing Authorization [CWE-862] and is exploitable remotely over the network without user interaction.

Successful exploitation results in disclosure of sensitive information handled by the plugin. The vulnerability does not require credentials, which broadens the pool of potential attackers to anyone who can reach an affected WordPress site.

Critical Impact
Unauthenticated remote attackers can bypass access controls in the JobSearch plugin to access protected resources, leading to confidentiality impact across affected WordPress installations.

Affected Products

WordPress JobSearch plugin (wp-jobsearch) versions <= 3.2.7
WordPress sites with the JobSearch plugin installed and active
Any hosting environment exposing vulnerable JobSearch endpoints to the network

Discovery Timeline

2026-06-17 - CVE-2026-49057 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49057

Vulnerability Analysis

The vulnerability resides in the WordPress JobSearch plugin (wp-jobsearch) at versions 3.2.7 and earlier. The plugin exposes functionality without verifying that the requester is authorized to invoke it. This is a classic Missing Authorization weakness, mapped to [CWE-862].

The CVSS vector indicates a confidentiality impact only, with no effect on integrity or availability. An attacker can retrieve protected information served by the plugin but cannot directly modify data or disrupt service through this specific flaw. The Exploit Prediction Scoring System (EPSS) probability is 0.296% as of 2026-06-18, placing it in the 21st percentile of known vulnerabilities.

Root Cause

The root cause is the absence of capability or nonce verification on one or more plugin endpoints. WordPress plugins typically guard privileged actions using current_user_can() checks or check_ajax_referer() calls. In affected JobSearch versions, these checks are missing or insufficient, allowing requests from unauthenticated sources to reach protected handlers.

Attack Vector

The attack vector is Network, requiring no privileges and no user interaction. An attacker crafts HTTP requests directly to the vulnerable plugin endpoint exposed by a WordPress site running JobSearch <= 3.2.7. The handler executes and returns data that should have been restricted to authenticated or authorized users.

For specific endpoint paths and request parameters, refer to the Patchstack advisory for the JobSearch broken access control vulnerability.

Detection Methods for CVE-2026-49057

Indicators of Compromise

Unauthenticated HTTP requests to wp-admin/admin-ajax.php with JobSearch-specific action parameters originating from external IPs
Anomalous request volume targeting /wp-content/plugins/wp-jobsearch/ paths
Outbound data responses of unusual size from JobSearch endpoints to unauthenticated clients

Detection Strategies

Inventory WordPress installations and identify sites running the JobSearch plugin at version 3.2.7 or earlier
Review web server access logs for repeated requests to JobSearch AJAX actions without an authenticated session cookie
Deploy WordPress security scanners that flag known vulnerable plugin versions against the Patchstack database

Monitoring Recommendations

Forward WordPress access and PHP error logs to a centralized SIEM for correlation and retention
Alert on requests to JobSearch endpoints that return HTTP 200 with large response bodies to unauthenticated clients
Track plugin version inventory across managed WordPress sites and trigger alerts when vulnerable versions are detected

How to Mitigate CVE-2026-49057

Immediate Actions Required

Update the JobSearch plugin to a version above 3.2.7 as soon as a patched release is available from the vendor
Identify all WordPress sites running wp-jobsearch and prioritize patching internet-facing instances
Restrict access to wp-admin/admin-ajax.php JobSearch actions at the web application firewall (WAF) layer until patched

Patch Information

Consult the Patchstack advisory for CVE-2026-49057 for the fixed version and remediation guidance. Apply the vendor-supplied update through the WordPress plugin manager or via wp-cli once published.

Workarounds

Temporarily deactivate the JobSearch plugin if patching is not immediately feasible
Apply WAF rules that block unauthenticated requests to JobSearch AJAX actions and REST endpoints
Restrict access to the WordPress site by IP allowlist where business requirements permit

bash

# Configuration example: identify vulnerable JobSearch installations with wp-cli
wp plugin list --name=wp-jobsearch --fields=name,status,version

# Update the plugin once a patched version is published
wp plugin update wp-jobsearch