CVE-2026-16258CWE-502insecure-deserialization

CVE-2026-16258

Critical · published August 7, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00849 · 57.7th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-08-07T10:16Z
References (1)
https://wpscan.com/vulnerability/8487a2ce-cb4d-46b8-942e-334ac94cf115/ · [email protected]
EPSS history
Timeline
  • 07 AUG 06:00Z
    Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint
    cvelistv5