Description

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-07T06:16:56.280Z",
  "pubdate": "2026-08-07T06:16:56.280Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability exists in the Ajax Search Lite WordPress plugin prior to version 4.14.5. The flaw stems from the insecure deserialization of untrusted input processed by the application.\nIf a suitable Property-Oriented Programming (POP) chain is present within the environment—potentially supplied by the plugin itself or another installed component—unauthenticated attackers can leverage this vulnerability to achieve Remote Code Execution on the underlying server.\nThe risk implications are severe, as successful exploitation bypasses authentication boundaries and allows arbitrary code execution with the privileges of the web server process. The attack requires network exposure to the vulnerable WordPress instance and the presence of complementary gadget chains to escalate the object injection into full system compromise.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling and deserialization of untrusted input by the Ajax Search Lite WordPress plugin before version 4.14.5. When application logic passes unsanitized user-supplied data directly into native PHP deserialization routines such as unserialize(), the PHP engine instantiates objects based on serialized data strings.\nBecause the input lacks cryptographic integrity checks or proper sanitization controls, an unauthenticated remote attacker can supply a specially crafted serialized payload containing malicious object structures. The vulnerable component processes this input over the network, triggering the __wakeup() or __destruct() magic methods of classes loaded within the PHP runtime context.\nTo achieve Remote Code Execution, the attacker must leverage a Property-Oriented Programming (POP) chain available through the execution environment. This typically involves chaining existing methods and properties of classes defined within the Ajax Search Lite plugin or other installed plugins and themes. When the serialized payload is unserialized, the execution flow is hijacked, directing execution toward dangerous sinks defined within the gadget chain.\nAttack flow involves the attacker sending an HTTP request containing the malicious serialized payload to the vulnerable endpoint exposed by Ajax Search Lite. The application processes the request and passes the data to the insecure deserialization routine without prior validation. Upon deserialization, the POP chain executes, leading to arbitrary code execution, file manipulation, or further post-exploitation activities depending on the available gadgets and server privileges."
}