CVE-2026-28139

CRITICAL

CVE: CVE-2026-28139 - Unauthenticated PHP Object Injection in Ajax Search Lite <= 4Sign in to save

CVSS

9.8

CVSS v3.1

EPSS

0.4%

Exploit Prediction Score

Published

August 6, 2026

Exploitability

EPSS probability 0.4%

Description

Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

CWE-502

No package data available.

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://patchstack.com/database/wordpress/plugin/ajax-search-lite/vulnerability/wordpress-ajax-search-lite-plugin-4-14-4…