What is the CVSS score of EUVD-2026-54389?

EUVD-2026-54389 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Ajax Search Lite are affected by EUVD-2026-54389?

The Ajax Search Lite WordPress plugin before version 4.14.5 contains a remote code execution vulnerability enabling unauthenticated attackers to fully compromise affected WordPress installations;…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-54389?

Yes, a public proof-of-concept exploit is available for EUVD-2026-54389. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-54389?

Within 24 hours, immediately upgrade Ajax Search Lite to version 4.14.5 or later on all affected WordPress installations and verify successful deployment in production environments. Within 7 days, audit all systems for exploitation artifacts by reviewing access logs, file integrity, and user account activity during the exposure window; confirm patch status across all WordPress instances and document inventory of remaining deployments. Within 30 days, implement a formalized WordPress plugin vulnerability scanning and patch management process, establish a maximum 48-hour remediation SLA for CVSS 9.0+ plugin vulnerabilities, and deploy automated update notifications or managed patching for all WordPress plugin environments.

Ajax Search Lite EUVD-2026-54389

| CVE-2026-16258 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-07 WPScan

GHSA-m7vw-4232-p79x

PHP WordPress RCE Deserialization Ajax Search Lite Unknown

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network reach and no user interaction, but full RCE requires a suitable POP gadget chain to be present, warranting AC:H; impact is total when achieved.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 19:26 vuln.today

Patch available

Aug 07, 2026 - 07:01 EUVD

CVE Published

Aug 07, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 07, 2026 - 06:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.

Articles & Coverage 1

News Critical PHP Object Injection in Ajax Search Lite WordPress Plugin - CVE-2026-16258 Aug 08, 2026

AnalysisAI

PHP Object Injection in the Ajax Search Lite WordPress plugin before 4.14.5 lets unauthenticated remote attackers pass untrusted serialized data into a PHP unserialize() sink, and where a suitable POP gadget chain exists in a co-installed plugin or theme, this escalates to remote code execution. Reported by WPScan with publicly available exploit code, it carries a CVSS 9.8 rating but a low EPSS of 0.22% (13th percentile), and is not listed in CISA KEV. A vendor patch is available in version 4.14.5.

Technical ContextAI

The flaw is a CWE-502 Deserialization of Untrusted Data issue in a WordPress search plugin written in PHP. Attacker-controlled input reaches PHP's unserialize() function, allowing instantiation of arbitrary PHP objects with attacker-defined properties. Object injection is only directly dangerous when a 'POP' (Property-Oriented Programming) gadget chain exists in loaded code - magic methods such as __wakeup(), __destruct(), or __toString() in the plugin itself, WordPress core, or another installed plugin/theme that can be strung together to perform file writes, SQL, or code execution. The CPE cpe:2.3:a:unknown:ajax_search_lite identifies the affected component, though the vendor field is marked unknown in the provided CPE data.

RemediationAI

Vendor-released patch: upgrade Ajax Search Lite to version 4.14.5 or later, which addresses the unsafe deserialization; this is the primary and confirmed fix (advisory: https://wpscan.com/vulnerability/8487a2ce-cb4d-46b8-942e-334ac94cf115/). If immediate patching is not possible, restrict or disable the plugin's AJAX search endpoints, and place the site behind a WAF with rules to block serialized PHP payloads (strings containing patterns like O:<n>:, a:, s:) in search parameters - noting this can cause false positives on legitimate input and is not a substitute for patching. Auditing and removing unnecessary co-installed plugins/themes reduces the pool of available POP gadget chains and thereby the chance of escalation to RCE, at the cost of the removed functionality. Do not rely on these workarounds long-term; the version 4.14.5 upgrade is the definitive remediation.