CVE-2026-16258— Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint
Quick assessment
Affected
Unknown Ajax Search Lite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Ajax Search Lite WordPress 插件 4.14.5 之前的版本中，未能防止对不受信任输入的反序列化，这允许未经身份验证的攻击者执行 PHP 对象注入。当通过其他已安装的 Ajax Search Lite WordPress 插件（版本低于 4.14.5）存在合适的 POP 链时，可以利用此漏洞实现远程代码执行。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Ajax Search Lite | < 4.14.5 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-16258
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Ajax Search Lite | 0 ~ 4.14.5 | - |
|
II. Public POCs for CVE-2026-16258
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16258
请登录查看更多情报信息。
News Coverage for CVE-2026-16258 (1)
-
🔗 Ajax Search Lite < 4.14.5 – Unauthenticated PHP Object Injection via Search Statistics REST Endpoint | CVE 2026-16258 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-07 · 21 CVEs total
| CVE-2026-15211 | 5.9 MEDIUM | Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Captur |
| CVE-2026-15148 | 5.3 MEDIUM | WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via I |
| CVE-2026-15239 | 5.3 MEDIUM | Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection B |
| CVE-2026-14205 | WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter | |
| CVE-2026-14943 | Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API | |
| CVE-2026-14331 | Subscribe2 < 10.46 - Reflected XSS via email Parameter | |
| CVE-2026-15032 | wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion | |
| CVE-2026-15215 | Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation | |
| CVE-2026-15214 | Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDO | |
| CVE-2026-15359 | Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite | |
| CVE-2026-15245 | BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode | |
| CVE-2026-16030 | MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication | |
| CVE-2026-16039 | MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR | |
| CVE-2026-16038 | MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways | |
| CVE-2026-15361 | Content Views < 4.5 - Subscriber+ SQL Injection via preview_request | |
| CVE-2026-15386 | Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text | |
| CVE-2026-16262 | Estatik < 4.3.3 - Login CSRF | |
| CVE-2026-16041 | MStore API < 4.21.0 - Unauthenticated Product Review Creation | |
| CVE-2026-16263 | WP Maps < 4.9.7 - Subscriber+ Local File Inclusion | |
| CVE-2026-16265 | WP Maps < 4.9.7 - Subscriber+ Denial of Service |
IV. Related Vulnerabilities
Same product: Ajax Search Lite
-
CVE-2026-28139
WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Inj -
CVE-2025-48086
WordPress Ajax Search Lite plugin <= 4.13.3 - PHP Object Inj -
CVE-2024-8619
Ajax Search Lite <= 4.12.2 - Admin+ Stored XSS -
CVE-2024-13585
Ajax Search Lite < 4.12.5 - Admin+ Stored XSS -
CVE-2024-10568
Ajax Search Lite < 4.12.4 - Admin+ Stored XSS
Same vendor: Unknown
-
CVE-2026-92924
Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbi -
CVE-2026-97219
MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via -
CVE-2026-91020
WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticat -
CVE-2026-90987
Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenti -
CVE-2026-90952
WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated S
V. Comments for CVE-2026-16258
No comments yet