Vulnerabilities / Ajax Search Lite / WPSEC-2026-0993
Ajax Search Lite <= 4.14.5 - Unauthenticated Sensitive Information Exposure of Password Protected Post Content via Search Results
Low 3.7
CWE-200Fixed in 4.14.6
- ID
- WPSEC-2026-0993
- Plugin
- Ajax Search Lite – Live Search & Filter (ajax-search-lite)
- Affected
- all versions before 4.14.6
- Remediation
- Update to 4.14.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-15
- Attack surface
- Ajax Search Lite on WPSec AttackSurface
- Fix released
- Published
Description
The Ajax Search Lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.14.5. When the 'Search and return password protected posts' option is enabled, the live search matches and returns the content and excerpt of password protected posts without checking whether the visitor entered the post password. This makes it possible for unauthenticated attackers to read the protected body of such posts. This is an incomplete fix of CVE-2025-7956, which only made the option disabled by default.
References
- https://wpsec.com/vuln/WPSEC-2026-0993/
- https://plugins.svn.wordpress.org/ajax-search-lite/tags/4.14.6/
- https://wordpress.org/plugins/ajax-search-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS