CVE-2026-16258 — Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint

CVE-2026-16258

Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint PUBLISHED

Description (CNA)

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.

Affected (CNA)

Vendor / product	Versions
Unknown / Ajax Search Lite	affected 0 before 4.14.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/8487a2ce-cb4d-46b8-942e-334ac94cf115/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.