CVE-2026-54186: WordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability

Synopsis

This is a SQL injection vulnerability in the WordPress JobSearch plugin (versions 3.2.9 and below). The flaw is reachable over the network with no authentication required, meaning any internet-facing WordPress site running an affected version is exposed. Successful exploitation gives an attacker the ability to read data from the underlying database and cause limited service disruption. HarborGuard is tracking the advisory for patch availability as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress site via HTTP/HTTPS to exploit this flaw.

• AuthenticationNot required

  No account or session token is needed; the injection is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  No victim action is required; the attacker sends crafted requests directly to the affected endpoint without any user involvement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• Attacker reads arbitrary data from the WordPress database, including user credentials, password hashes, email addresses, and any stored job-seeker or employer records managed by the plugin.
• The scoped impact (S:C) means data exposure can extend beyond the plugin's own tables to other data accessible by the database user, potentially including records from other plugins or WordPress core tables.
• The attacker causes limited disruption to database availability, consistent with a low availability impact rating, which may manifest as degraded query performance or intermittent errors for site visitors.