Ajax Search Lite
Monthly
PHP Object Injection in the Ajax Search Lite WordPress plugin before 4.14.5 lets unauthenticated remote attackers pass untrusted serialized data into a PHP unserialize() sink, and where a suitable POP gadget chain exists in a co-installed plugin or theme, this escalates to remote code execution. Reported by WPScan with publicly available exploit code, it carries a CVSS 9.8 rating but a low EPSS of 0.22% (13th percentile), and is not listed in CISA KEV. A vendor patch is available in version 4.14.5.
PHP Object Injection in the Ajax Search Lite WordPress plugin (versions ≤ 4.14.4) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling object instantiation that - when paired with a suitable gadget chain in the plugin or wider WordPress runtime - can lead to remote code execution, data theft, or site takeover. Reported by Patchstack and tracked as EUVD-2026-53942, it carries a CVSS of 9.8 (fully unauthenticated network vector). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
PHP Object Injection in the Ajax Search Lite WordPress plugin before 4.14.5 lets unauthenticated remote attackers pass untrusted serialized data into a PHP unserialize() sink, and where a suitable POP gadget chain exists in a co-installed plugin or theme, this escalates to remote code execution. Reported by WPScan with publicly available exploit code, it carries a CVSS 9.8 rating but a low EPSS of 0.22% (13th percentile), and is not listed in CISA KEV. A vendor patch is available in version 4.14.5.
PHP Object Injection in the Ajax Search Lite WordPress plugin (versions ≤ 4.14.4) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling object instantiation that - when paired with a suitable gadget chain in the plugin or wider WordPress runtime - can lead to remote code execution, data theft, or site takeover. Reported by Patchstack and tracked as EUVD-2026-53942, it carries a CVSS of 9.8 (fully unauthenticated network vector). No public exploit is identified at time of analysis, and it is not listed in CISA KEV.