VK Google Job Posting Manager: PHP Object Injection via deserialization
Summary
The WordPress plugin VK Google Job Posting Manager up to version 1.3.1 deserializes untrusted data, which allows PHP object injection (CWE-502). An attacker with low privileges can potentially manipulate how the site processes data and run harmful actions on the server. The actual impact depends on the PHP gadget chains present on the affected site, which could not be assessed.
Affected
- VK Google Job Posting Manager WordPress plugin, all versions through 1.3.1 (Vektor Inc.)
Fixed in
- Update to version 1.3.2 or later, according to the Patchstack advisory and CVE record.
- Unverified: 1.3.2 could not be confirmed on WordPress.org; check the installed version against the latest release there.
Workaround
Unknown. No workaround is documented in the sources. If no fixed version can be installed, disable and remove the plugin.
Exploitation
- Not marked as known exploited; not listed in CISA KEV according to a third-party tracker.
- Patchstack rates the flaw as expected to become exploited; mitigation rules have been issued.
- Public proof of concept: none found; treat as unknown.
Our recommendation
- Update the plugin to the latest version from WordPress.org immediately, or remove it if it is not needed, since it only generates JSON-LD markup.
- Review user accounts for unexpected low-privilege entries.
- Check WordPress core and other plugins for available updates.
- Monitor for unusual server activity and consider a web application firewall rule as a temporary mitigation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- WordPress.org plugin directory wordpress.org
- Positive Technologies PT-2026-106168 (Vulners) vulners.com
- HOL Guard CVE entry hol.org
- Strix CVE entry www.strix.ai
- Plugin Tests (Plugin Directory data) plugintests.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:30.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.