What is the CVSS score of CVE-2026-28139?

CVE-2026-28139 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Ajax Search Lite are affected by CVE-2026-28139?

Ajax Search Lite WordPress plugin versions 4.14.4 and earlier contain a critical PHP object injection vulnerability enabling unauthenticated remote attackers to execute arbitrary code and achieve…

How to fix or mitigate CVE-2026-28139?

Within 24 hours, identify all WordPress instances running Ajax Search Lite plugin version 4.14.4 or earlier and deactivate the plugin across all environments immediately. Within 7 days, audit systems for signs of prior compromise (check file modification timestamps, database audit logs, and access logs from the vulnerability disclosure date), evaluate replacement search plugins, and develop a migration plan. Within 30 days, completely remove Ajax Search Lite from all systems, deploy a maintained alternative search solution (such as Relevanssi or SearchWP), verify functionality, and conduct post-remediation security scanning to confirm no persistent backdoors remain.

Ajax Search Lite CVE-2026-28139

EUVD-2026-53942 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-fggq-3fv5-w95m

PHP WordPress Deserialization Wordpress Plugin Ajax Search Lite

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network deserialization sink (PR:N/UI:N/AV:N/AC:L); assuming a reachable gadget chain yields full RCE-level C/I/A:H, consistent with the reported vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:19 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

Articles & Coverage 1

News Critical PHP Object Injection in Ajax Search Lite WordPress Plugin - CVE-2026-28139 Aug 07, 2026

AnalysisAI

PHP Object Injection in the Ajax Search Lite WordPress plugin (versions ≤ 4.14.4) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling object instantiation that - when paired with a suitable gadget chain in the plugin or wider WordPress runtime - can lead to remote code execution, data theft, or site takeover. Reported by Patchstack and tracked as EUVD-2026-53942, it carries a CVSS of 9.8 (fully unauthenticated network vector). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Ajax Search Lite (vendor slug wpdreams, CPE cpe:2.3:a:wpdreams:ajax_search_lite) is a live/AJAX search widget plugin for WordPress that processes search-related requests, typically via admin-ajax.php or REST endpoints reachable without login. The root cause is CWE-502 (Deserialization of Untrusted Data): user-supplied input reaches PHP's unserialize() without validation, allowing an attacker to forge serialized PHP objects. On instantiation/destruction these objects invoke PHP magic methods (__wakeup, __destruct, __toString), and if a 'gadget' class with dangerous behavior is loadable in the WordPress process, the injected object chain can be leveraged for file operations, SQL, or code execution. The impact ceiling therefore depends on gadget availability in the plugin, WordPress core, or co-installed plugins/themes.

RemediationAI

No vendor-released patch version is identified at time of analysis in the provided data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ajax-search-lite/vulnerability/wordpress-ajax-search-lite-plugin-4-14-4-php-object-injection-vulnerability) for the fixed release and upgrade to a version above 4.14.4 as soon as it is available. Until a confirmed fixed version is installed, reduce exposure by deploying a WordPress WAF/virtual patch (Patchstack or equivalent) to filter serialized-object payloads to the plugin's AJAX/search endpoints, restricting or rate-limiting access to admin-ajax.php actions used by the plugin, and - if the search feature is non-essential - deactivating and removing the plugin entirely; note that WAF rules can be bypassed by novel encodings and deactivating the plugin removes site search functionality, so validate each control against your deployment.