CVE-2026-110360
MediumCVSS 5.3Summary
The WordPress plugin 'Ajax Search Lite' (versions up to 4.14.5) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker could gain access to search functions or data they are not authorized to use, potentially compromising confidentiality.
Recommendation
Update the 'Ajax Search Lite' plugin to the latest version that fixes this vulnerability.
Other vulnerabilities in Ajax Search Lite
See all- CVE-2026-16258Critical
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed plugin, this can be leveraged to achieve Remote Code Execution.
- CVE-2026-28139Critical
Unauthenticated PHP Object Injection vulnerability in Ajax Search Lite versions up to 4.14.4.
Original NVD description (English source)
Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ajax Search Lite: from n/a through 4.14.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS