CVE Intelligence
Analysis AI-assisted

CVE-2026-27049: NooTheme Jobica Core Authentication Bypass via Alternate Channel (CWE-288)

CVE-2026-27049 is an authentication bypass using an alternate path or channel (CWE-288) in NooTheme Jobica Core (jobica-core), with the record stating affected versions through 1.4.2. The CNA Patchstack rates it critical with a CVSS 3.1 base score of 9.8. The record provides no fixed version and no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-27049 describes an authentication bypass using an alternate path or channel, classified as CWE-288, in NooTheme Jobica Core (jobica-core). The record was published on 2026-03-25 with Patchstack as the CNA, and NVD lists its status as Deferred.

Impact

  • The CNA scores the issue as critical, with a CVSS 3.1 base score of 9.8 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The vector indicates remote network access, low complexity, no privileges required and no user interaction, with high impact to confidentiality, integrity and availability.
  • The slug of the Patchstack reference URL mentions an account takeover. This suggests account compromise is a plausible consequence, but the record text itself does not confirm it.

Affected products and versions

  • Product: Jobica Core (jobica-core) by NooTheme.
  • The stated range is from n/a through 1.4.2 (less than or equal to 1.4.2). The lower bound is not specified.
  • The record contains no structured affected or fixed version entries.
  • The reference URL path suggests this is a WordPress plugin, which is an inference from the Patchstack database location.

Exploitation status

CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted. The record gives an EPSS probability of 0.00643 with a percentile of 0.49446, which is an estimate and not evidence of exploitation.

Remediation and mitigation

  • Identify all installations of Jobica Core and record the installed version.
  • Because the record lists no fixed version, check the Patchstack page and the vendor channels for an updated release and apply it when it is verified.
  • Until a fix is confirmed, consider limiting access to administrative and authentication functions, reviewing existing accounts and enforcing strong authentication, such as multi-factor authentication where supported.
  • Rotate credentials for administrative accounts if compromise is suspected.

Detection guidance

  • Review authentication logs for successful logins that lack expected prior activity or that originate from unusual sources.
  • Audit recently created or modified user accounts and role assignments.
  • Look for administrative sessions or configuration changes that the site owners do not recognize.

Limitations of the available information

  • The record does not list a fixed version, so the existence and location of a patch are unknown.
  • The lower bound of the affected range is recorded as n/a.
  • The record does not describe the technical mechanism of the bypass beyond the CWE classification and the reference.
  • The account takeover interpretation is based only on the reference URL slug.

Frequently asked questions

What is CVE-2026-27049?

It is an authentication bypass using an alternate path or channel (CWE-288) in NooTheme Jobica Core (jobica-core), with affected versions stated through 1.4.2.

How severe is it?

Patchstack, as the CNA, scores it critical with a CVSS 3.1 base score of 9.8 and a network-reachable, no-privilege, no-interaction vector.

Is there a fixed version?

The record does not list a fixed version. Check the Patchstack page and vendor channels for an update.

Is it being exploited?

CISA KEV does not list this CVE and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.