PHP Object Injection Vulnerability in Ajax Search Lite Plugin by WordPress
CVE-2026-16258
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 7 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16258?
The Ajax Search Lite plugin for WordPress, prior to version 4.14.5, is vulnerable due to its failure to properly validate deserialized input. This weakness allows unauthenticated attackers to exploit PHP Object Injection, especially when an appropriate Properties Object Payload (POP) chain is available through another vulnerable installation of the Ajax Search Lite plugin. This can ultimately facilitate Remote Code Execution, posing significant security risks to affected websites.
Affected Version(s)
Ajax Search Lite 0 < 4.14.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.