The NooTheme Jobica Core plugin contains a critical object injection vulnerability that allows authenticated attackers to execute arbitrary code or compromise system integrity.

The plugin fails to properly sanitize input during deserialization, which allows an authenticated user with low privileges to perform PHP object injection. This flaw resides within the jobica-core component and can lead to full system compromise.

The exploitation of this vulnerability poses a severe risk to organizational infrastructure, potentially leading to unauthorized remote code execution, data exfiltration, or total system takeover. With a CVSS score of 8.8, this high-severity flaw represents a significant threat to the confidentiality, integrity, and availability of the hosting environment and any connected sensitive databases.

Immediate Action: Since no specific patch version is currently confirmed, administrators should immediately deactivate or uninstall the NooTheme Jobica Core plugin until a security update is released by the vendor.

Proactive Monitoring: Security teams should review application logs for suspicious serialized strings or unusual PHP error patterns that may indicate attempts to trigger object injection.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common PHP object injection payloads and unauthorized POST requests to the plugin's endpoints.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for full system compromise, this vulnerability must be treated as a priority. Administrators should monitor official vendor channels for a patched version and restrict access to the affected plugin functionality until a definitive update is verified and applied.