The eyecix JobSearch WordPress plugin versions up to 2.5.9 contain a deserialization of untrusted data vulnerability that permits object injection attacks. This vulnerability arises when the plugin processes serialized data from untrusted sources without proper validation or sanitization, enabling attackers to execute arbitrary code or manipulate application logic. The vulnerability is remotely exploitable without authentication, with a CVSS 3.1 base score of 9.8, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected WordPress site, including arbitrary code execution, data manipulation, and denial of service. The high CVSS score reflects the critical nature of the flaw, with no privileges or user interaction required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the affected plugin functionality and monitor for suspicious activity. Avoid using the vulnerable plugin version and consider disabling or removing it if possible.