Unrated severityNVD Advisory· Published Aug 7, 2026
CVE-2026-16258
CVE-2026-16258
Description
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <4.14.5
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.