Description

Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T15:16:52.580Z",
  "pubdate": "2026-08-06T15:16:52.580Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the Ajax Search Lite plugin, specifically affecting versions 4.14.4 and prior. This security flaw enables remote, unauthenticated attackers to supply crafted serialized objects via vulnerable AJAX parameters processed by the plugin.\nThe primary impact of this vulnerability involves potential security boundary bypasses, which can escalate depending on the presence of specific gadget chains within the local PHP environment. Because the vulnerability requires no authentication and is accessible over the network via standard HTTP requests, the overall risk implication is severe for improperly hardened WordPress installations.\nExploitation prerequisites include a target running a vulnerable version of Ajax Search Lite where user-supplied input is improperly sanitized or unserialized without adequate validation constraints. Successful exploitation allows an attacker to instantiate arbitrary classes, potentially leading to downstream security consequences such as remote code execution, arbitrary file operations, or data tampering depending on available application context and dependencies.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure deserialization practices within the Ajax Search Lite codebase. Specifically, the application processes incoming parameters through PHP's unserialize() function (or an insecure equivalent handling mechanism) without properly validating or sanitizing the input data structure prior to instantiation.\nThe vulnerable component resides within the AJAX request handling routines of Ajax Search Lite <= 4.14.4. Network exposure is direct, as the affected endpoints are exposed to unauthenticated external users interacting with the WordPress AJAX interface.\nAuthentication and privilege requirements are absent; the attack surface is completely unauthenticated, permitting remote actors to interact directly with the vulnerable AJAX actions exposed by the plugin.\nThe attack flow proceeds as follows: First, the attacker identifies the vulnerable AJAX action endpoint exposed by Ajax Search Lite. Second, the attacker crafts a malicious serialized PHP object payload designed to leverage available gadget chains within WordPress core, themes, or other installed plugins. Third, the attacker transmits this payload via an HTTP GET or POST request directed at the vulnerable AJAX handler. Fourth, the application receives the payload and passes it to the insecure unserialize() routine. Fifth, PHP instantiates the objects contained within the payload, triggering destructors, __wakeup(), or __toString() methods defined within the gadget chain.\nPayload behavior relies heavily on the specific classes available in the target application's memory space at the time of execution. While PHP Object Injection itself allows the creation of arbitrary object states, the ultimate post-exploitation impact is dictated by the utility of the available gadget classes. Potential outcomes range from denial of service and file deletion to Remote Code Execution (RCE) if a viable gadget chain exists within the environment."
}