CVE-2026-28139

CriticalCVSS 9.8

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Unauthenticated PHP Object Injection vulnerability in Ajax Search Lite versions up to 4.14.4.

An attacker can inject malicious PHP objects, potentially leading to remote code execution or other severe impacts.

Update the Ajax Search Lite plugin to the latest patched version.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.