CVE-2026-16258
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed plugin, this can be leveraged to achieve Remote Code Execution.
Risk Assessment
The risk includes remote code execution by an unauthenticated attacker, potentially leading to full compromise of the WordPress site and data breach.
Recommendation
Update the Ajax Search Lite plugin to version 4.14.5 or later. Also, avoid installing additional plugins that may provide POP chains.
Original NVD description (English source)
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.