CVE-2026-28139

CriticalCVSS 9.8

Published: 06/08/2026(UTC)Updated: 06/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Summary

Unauthenticated PHP Object Injection vulnerability in Ajax Search Lite versions up to 4.14.4.

An attacker can inject malicious PHP objects, potentially leading to remote code execution or other severe impacts.

Update the Ajax Search Lite plugin to the latest patched version.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.