CVE-2026-28139: Critical PHP Object Injection in Ajax Search Lite

Executive Summary

A critical unauthenticated PHP object injection vulnerability (CVE-2026-28139) has been disclosed in Ajax Search Lite, a widely used live search plugin for WordPress with over 80,000 active installations. The vulnerability carries a CVSS score of 9.8 and affects versions 4.14.4 and earlier.

CVSS Score: 9.8 (Critical)

The flaw allows any unauthenticated visitor to inject a malicious serialized PHP object into the application. When a suitable Property-Oriented Programming (POP) chain exists in the WordPress environment — a common condition on WordPress 6.4+ sites — this escalates to full remote code execution (RCE). A patch is available in version 4.14.5.

Vulnerability Overview

Affected Versions

Technical Analysis

What Is PHP Object Injection?

PHP Object Injection is a class of deserialization vulnerability (CWE-502) that occurs when user-supplied data is passed directly to PHP's unserialize() function without validation or class restriction. PHP's deserialization process automatically instantiates objects and invokes magic methods (__wakeup, __destruct, __toString, etc.) as part of reconstruction — executing code that the application never intended to run.

How It Works in Ajax Search Lite

1. Plugin accepts user input (e.g. search query or AJAX parameter)
2. Input is passed directly to PHP's unserialize() without class restriction
3. Attacker supplies a crafted serialized payload encoding a malicious object
4. PHP deserializes the payload, instantiating an attacker-chosen class
5. Magic methods (__wakeup, __destruct, etc.) fire automatically
6. If a POP chain gadget exists in loaded code → Remote Code Execution

The POP Chain Requirement

Without a suitable gadget chain in the environment, object injection is still exploitable for:

• Arbitrary file deletion
• Server-Side Request Forgery (SSRF)
• Database manipulation

However, when a POP chain exists — most commonly via the WP_HTML_Token class available in WordPress 6.4+ — the vulnerability escalates to full RCE. Most WordPress installations running a current core version are exposed to this escalation path.

CVSS 9.8 Breakdown

The score reflects that any internet-facing WordPress site running the affected plugin is exploitable with a single HTTP request — no login, no social engineering, no prerequisites beyond a loaded POP gadget (which is extremely common).

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update Ajax Search Lite to 4.14.5

# Via WP-CLI
wp plugin update ajax-search-lite
 
# Verify installed version
wp plugin get ajax-search-lite --field=version

Or via WordPress Admin → Plugins → Installed Plugins → Ajax Search Lite → Update Now.

Patchstack subscribers also received a virtual patch prior to the official release — verify your WAF rules are active.

Step 2: Scan for Compromise

# Check for unexpected PHP files in uploads or plugin directories
find /path/to/wordpress/wp-content/ -name "*.php" \
  -newer /path/to/wordpress/wp-includes/version.php -type f
 
# Search for common webshell signatures
grep -rl "eval\s*(base64_decode" /path/to/wordpress/wp-content/
grep -rl "system\s*(" /path/to/wordpress/wp-content/uploads/
 
# Verify WordPress core integrity
wp core verify-checksums
 
# List recently registered administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_registered

Step 3: Harden Deserialization Exposure

• Audit other installed plugins for known unserialize() patterns using tools like RIPS or static analysis scanners
• Ensure unserialize() calls in plugins use the allowed_classes parameter to restrict which classes can be instantiated:

// Secure pattern — restrict which classes can be deserialized
$data = unserialize($input, ['allowed_classes' => false]);
 
// Vulnerable pattern — no class restriction
$data = unserialize($input);

If Immediate Patching Is Not Possible

1. Deactivate Ajax Search Lite entirely until patched
2. Enable WAF virtual patch through Patchstack or Wordfence if subscribed
3. Block suspicious search requests containing serialized PHP payload patterns at the web server or WAF level:

   Pattern: O:[0-9]+:"[^"]+":
   

   Copy
4. Monitor access logs for deserialization payload indicators

Detection Indicators

Post-Remediation Steps

1. Confirm Ajax Search Lite updated to 4.14.5 or later
2. Remove any unauthorized files or accounts created during exposure window
3. Rotate all WordPress admin passwords and security keys:

   wp config shuffle-salts

   Copy

4. Review server and WordPress access logs for evidence of exploitation
5. Deploy a Web Application Firewall with deserialization attack rules
6. Implement file integrity monitoring on the WordPress installation
7. Subscribe to plugin vulnerability alerts via Patchstack or Wordfence

References

• NIST NVD — CVE-2026-28139
• Patchstack — Ajax Search Lite Vulnerabilities
• Wordfence Intelligence — Ajax Search Lite
• Ajax Search Lite — WordPress.org Plugin Page
• PHP Object Injection in WordPress Plugins — Invicti

Related Reading

• CVE-2026-28005: Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• CVE-2026-3589: WooCommerce CSRF Flaw Allows Unauthenticated Admin Takeover