CVE-2026-16258
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed plugin, this can be leveraged to achieve Remote Code Execution.
Risk Assessment
The risk includes remote code execution by an unauthenticated attacker, potentially leading to full compromise of the WordPress site and data breach.
Recommendation
Update the Ajax Search Lite plugin to version 4.14.5 or later. Also, avoid installing additional plugins that may provide POP chains.
Other vulnerabilities in Ajax Search Lite
See all- CVE-2026-28139Critical
Unauthenticated PHP Object Injection vulnerability in Ajax Search Lite versions up to 4.14.4.
- CVE-2026-110360Medium
The WordPress plugin 'Ajax Search Lite' (versions up to 4.14.5) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2025-48086Medium
The WordPress plugin Ajax Search Lite (versions up to and including 4.13.3) is vulnerable to deserialization of untrusted data, allowing object injection. The flaw stems from unsafe processing of input data.
Original NVD description (English source)
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS