CVE-2025-48086
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The WordPress plugin Ajax Search Lite (versions up to and including 4.13.3) is vulnerable to deserialization of untrusted data, allowing object injection. The flaw stems from unsafe processing of input data.
Risk Assessment
This could lead to remote code execution or other severe impacts depending on available classes in the WordPress environment. Organizations using this plugin are at risk of application compromise.
Recommendation
Update the Ajax Search Lite plugin to the latest version (above 4.13.3) or disable it if updating is not possible.
Other vulnerabilities in Ajax Search Lite
See all- CVE-2026-16258Critical
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed plugin, this can be leveraged to achieve Remote Code Execution.
- CVE-2026-28139Critical
Unauthenticated PHP Object Injection vulnerability in Ajax Search Lite versions up to 4.14.4.
- CVE-2026-110360Medium
The WordPress plugin 'Ajax Search Lite' (versions up to 4.14.5) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS