Vulnerabilities CVE-2026-16258

CVE-2026-16258

None

Open

TLP:CLEAR

Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.

Details

EPSS Score ⓘ: 0.47%

38.5th percentile
Confidence: 90%
Published: Aug 7, 2026
Last Modified: Aug 7, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.