CVE-2026-28139
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Unauthenticated PHP Object Injection vulnerability in Ajax Search Lite versions up to 4.14.4.
Risk Assessment
An attacker can inject malicious PHP objects, potentially leading to remote code execution or other severe impacts.
Recommendation
Update the Ajax Search Lite plugin to the latest patched version.
Other vulnerabilities in Ajax Search Lite
See all- CVE-2026-16258Critical
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed plugin, this can be leveraged to achieve Remote Code Execution.
- CVE-2026-110360Medium
The WordPress plugin 'Ajax Search Lite' (versions up to 4.14.5) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2025-48086Medium
The WordPress plugin Ajax Search Lite (versions up to and including 4.13.3) is vulnerable to deserialization of untrusted data, allowing object injection. The flaw stems from unsafe processing of input data.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS