CVE-2026-100511: Deserialization of Untrusted Data in Vektor Inc. VK Google Job Posting Manager

The VK Google Job Posting Manager plugin by Vektor Inc. suffers from a deserialization of untrusted data vulnerability, enabling object injection attacks. This issue affects all versions from initial release through 1.3.1. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity, with network attack vector, low attack complexity, requiring low privileges and no user interaction. Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability impacts.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to execute arbitrary code, manipulate data, or cause denial of service. This compromises the confidentiality, integrity, and availability of the affected system running the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and monitor for suspicious activity related to deserialization processes.