NooTheme Jobica Core PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the NooTheme Jobica Core plugin, affecting versions through 1.4.1. This vulnerability could lead to various types of code injection, including SQL injection, path traversal, and denial-of-service, especially if a suitable property-oriented programming chain is exploited.

Impact

This vulnerability allows PHP object injection, which could be leveraged to execute code injection, SQL injection, path traversal, denial-of-service, and more, if a proper property-oriented programming chain is present.

Remediation

Users of the NooTheme Jobica Core plugin should update to version 1.4.2 or later. Patchstack users can enable auto-update for vulnerable plugins.