WordPress Plugin Vulnerabilities

Ajax Search Lite < 4.13.2 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handler

Description

The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of any protected post in rolling 100‑character windows.

Affects Plugins

Plugin icon
ajax-search-lite
Fixed in 4.13.2

References

CVE
CVE-2025-7956
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/daa9c3dd-e8cf-4696-bc0c-4088509f89db

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
stealthcopter
Verified
No
WPVDB ID
55b37d59-a1c3-414c-808b-49030512689d

Timeline

Publicly Published
2025-08-27 (about 10 months ago)
Added
2025-08-27 (about 10 months ago)
Last Updated
2025-08-28 (about 10 months ago)

Other

Published
Title
Published
2026-02-15
Title
WPLifeCycle < 4.0 - Missing Authorization
Published
2025-11-07
Title
Gallery Plugin for WordPress – Envira Photo Gallery < 1.12.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion
Published
2024-03-07
Title
TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds < 1.4.11 - Missing Authorization to Authenticated (Subscriber+) User Email Export
Published
2024-12-06
Title
If Menu < 0.19.2 - Missing Authorization to License Key Update
Published
2026-01-07
Title
Speed Kit <= 2.0.2 - Missing Authorization