CVE-2026-111852: Ajax Search Lite WordPress Plugin — Critical Blind SQL Injection

Executive Summary

A critical blind SQL injection vulnerability has been published for Ajax Search Lite (ajax-search-lite), a live-search plugin for WordPress from WPdreams. Tracked as CVE-2026-111852 with a CVSS score of 9.3, the flaw stems from improper neutralization of special elements used in an SQL command.

The NVD entry was published on 2026-10-21 and lists affected versions as from n/a through 4.14.6.

Vulnerability Overview

Root Cause

User-controlled input reaches an SQL query without adequate sanitization. Because the injection is blind, results are not returned directly; attackers infer data through response differences or timing, typically using automated tooling.

Impact

• Database disclosure: user records, password hashes, and site secrets stored in WordPress tables
• Credential theft that can lead to administrator takeover after hash cracking
• Data tampering depending on database privileges
• A search plugin is usually exposed on public pages, which widens the attack surface

Remediation

1. Update Ajax Search Lite to a release later than 4.14.6 when available; check the plugin repository for status.
2. If no fix is available, disable the plugin or replace the site's search feature temporarily.
3. Review web and database logs for long-running or unusual search queries and time-delay payloads.
4. Rotate WordPress salts and administrator passwords if exploitation is suspected.

Hardening

• Run the WordPress database user with least privilege
• Deploy a WAF with SQL injection rules
• Rate-limit search endpoints such as admin-ajax.php

Key Takeaways

1. CVSS 9.3 — critical severity
2. Versions through 4.14.6 are affected
3. Blind SQLi is slower to exploit by hand but easy to automate
4. Patch or disable the plugin, then review logs for abuse

References

• NVD — CVE-2026-111852
• OWASP — SQL Injection