External risk intelligence

Ajax Search Lite PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-28139

Ajax Search Lite is a WordPress plugin designed to provide search functionality on public-facing websites. As a web-based search component, it is commonly deployed in a manner that is directly accessible to internet users to enable site functionality.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in a popular WordPress search plugin that could allow unauthorized access and manipulation of systems if exploited. This issue impacts the plugin's handling of data, presenting a significant risk to the integrity and confidentiality of information. The main concern is confirming the relevance and exposure of this vulnerability within our environment.

Unauthenticated injection in a common search tool.
Potential for unauthorized data access or modification.
Confirm if this search tool is in use.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending a crafted request to a website using the Ajax Search Lite plugin. This could allow them to inject malicious PHP objects, potentially leading to full compromise of the website.

Requires no authentication to access.
Triggers by sending malicious data.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Ajax Search Lite plugin could allow an unauthenticated attacker to inject PHP objects, potentially leading to the execution of arbitrary code on the server when processed by the application. This could affect the integrity and availability of the website and its underlying infrastructure.

Affected asset: Website server.
Exposure: Unauthenticated remote code execution.
Consequence: Compromised website and server.

Operational Fix

Recommended remediation, mitigation, and detection steps

The unauthenticated PHP Object Injection in Ajax Search Lite affects organizations using this plugin on their WordPress sites. Immediate action should focus on identifying all instances of the plugin, determining their exposure and criticality, and then engaging the accountable team, likely application or platform owners, to plan remediation. Coordination with the vendor for a fix or the implementation of mitigating controls should follow risk assessment.

Application owners should prioritize remediation.
Verify plugin reachability and business criticality.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ajax Search Lite?

Ajax Search Lite is a plugin for WordPress websites that enhances the user experience by adding a live, dynamic search bar. It allows visitors to find content on a site more quickly by displaying results as they type. Developers typically integrate this tool to improve site navigation and usability for public-facing web pages.

What does PHP object injection mean for CVE-2026-28139?

This vulnerability, classified as CWE-502, occurs when an application improperly handles user-provided data. Because the plugin does not safely validate this input, an attacker can supply a specially crafted PHP object. When the application processes this input, it may inadvertently execute unintended code, effectively tricking the site into performing actions dictated by the malicious object.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a crafted request containing malicious data directly to the plugin. Because this is an unauthenticated vulnerability, the attacker does not need to have a user account or special permissions on your website. Note that simply visiting the site normally or performing standard searches will not trigger the bug; it requires specifically prepared data designed to exploit the plugin's data handling flaws.

Is my website at risk from this CVE?

According to Halo Surface Signal, this plugin is designed to be public-facing to serve users, which inherently increases your risk profile. If your website uses Ajax Search Lite, it is likely accessible to internet users, meaning an attacker could reach the vulnerable component. You should prioritize assessing any WordPress site where this plugin is active and reachable over the network.

How do I respond to CVE-2026-28139?

Start by identifying every WordPress instance in your environment that has this plugin installed. Once you have a list of affected sites, coordinate with the site owners to evaluate their business necessity and exposure. Your primary goal is to mitigate the risk, which may involve disabling the plugin, applying vendor-supplied updates, or implementing other security controls while you verify the stability of your infrastructure.

References

patchstack.com/database/wordpress/plugin/ajax-search-lite/vulnerabil…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.