WordPress Plugin Vulnerabilities

Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint

Description

The plugin does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed plugin or theme, this can be leveraged to achieve Remote Code Execution.

Proof of Concept

Affects Plugins

Plugin icon
ajax-search-lite
Fixed in 4.14.5

References

CVE
CVE-2026-16258

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
8.1 (high)

Miscellaneous

Original Researcher
Jakub Herman
Submitter
Jakub Herman
Submitter website
https://www.jakubherman.net
Verified
Yes
WPVDB ID
8487a2ce-cb4d-46b8-942e-334ac94cf115

Timeline

Publicly Published
2026-08-03 (about 1 month ago)
Added
2026-08-03 (about 1 month ago)
Last Updated
2026-09-09 (about 18 hours ago)

Other

Published
Title
Published
2024-02-22
Title
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Authenticated (Contributor+) PHP Object Injection
Published
2018-11-23
Title
Patreon Connect < 1.2.2 - PHP Object Injection
Published
2017-10-12
Title
Invite Anyone <= 1.3.18 - Unauthenticated PHP Object Injection
Published
2025-03-27
Title
Rapyd Payment Extension for WooCommerce < 1.2.1 - Unauthenticated PHP Object Injection
Published
2025-01-06
Title
Custom Product Tabs for WooCommerce <= 1.8.5 - Shop Manager+ PHP Object Injection