CVE-2026-27049: 
WordPress vulnerability analysis and mitigation

CVE-2026-27049 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the NooTheme Jobica Core WordPress plugin, classified as an account takeover vulnerability. It affects Jobica Core versions up to and including 1.4.2, with no official patch available at the time of disclosure. The vulnerability was reported on December 14, 2025, by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) and published by Patchstack on March 16, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Patchstack).

The vulnerability is rooted in broken authentication logic (CWE-288) within the Jobica Core plugin, which allows attackers to bypass standard authentication controls via an alternate path or channel. This falls under OWASP Top 10 category A7: Identification and Authentication Failures. No authentication, user interaction, or elevated privileges are required to exploit the flaw — an unauthenticated remote attacker can abuse alternate authentication channels to gain unauthorized access, potentially achieving admin-level control over the WordPress site. No public proof-of-concept code has been disclosed (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform account takeover, gaining access to privileged user accounts including site administrators. This can result in unauthorized access to sensitive applicant and job posting data, modification or deletion of content, and full compromise of the WordPress installation. Given the plugin's role in job board functionality, exposed data may include personally identifiable information (PII) of job applicants, and a compromised admin account could enable further lateral movement within the hosting environment (Patchstack).

There is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.024%, indicating a currently low probability of exploitation in the near term. However, Patchstack classifies this as high priority and notes that vulnerabilities of this severity are frequently used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. No threat actor attribution has been made, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

No official patch from the vendor (NooTheme) is available for Jobica Core as of the time of disclosure. Patchstack has issued a virtual patching/mitigation rule to block exploitation attempts for users of its service. Site administrators should consider temporarily disabling the Jobica Core plugin until an official fix is released. Additionally, implementing network-level access controls, monitoring authentication logs for anomalous login activity, and restricting access to WordPress admin endpoints are recommended interim measures (Patchstack).

The vulnerability was discovered and disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and reported through Patchstack's coordinated disclosure process. Patchstack has flagged it as high priority, warning that vulnerabilities of this class are commonly leveraged in mass WordPress exploitation campaigns. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).