CVE-2026-111852: WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/ajax-search-liteto a version that resolves this vulnerability.Fixed in 4.14.7
Event History
Frequently Asked Questions
Does exploiting this issue require an authenticated WordPress account or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
Which deployments fall within the affected version range?
Ajax Search Lite versions through 4.14.6 are identified as affected. The available data does not specify a lower bound.
What level of impact is indicated if the vulnerability is exploited?
The CVSS vector indicates high confidentiality impact, no integrity impact, and low availability impact. It also indicates that the vulnerability can affect components beyond the vulnerable plugin's security authority.