{
 "id": "WPSEC-2026-0993",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0993/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0993/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0993/index.md",
 "title": "Ajax Search Lite <= 4.14.5 - Unauthenticated Sensitive Information Exposure of Password Protected Post Content via Search Results",
 "description": "The Ajax Search Lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.14.5. When the 'Search and return password protected posts' option is enabled, the live search matches and returns the content and excerpt of password protected posts without checking whether the visitor entered the post password. This makes it possible for unauthenticated attackers to read the protected body of such posts. This is an incomplete fix of CVE-2025-7956, which only made the option disabled by default.",
 "plugin": {
  "slug": "ajax-search-lite",
  "name": "Ajax Search Lite",
  "full_name": "Ajax Search Lite – Live Search & Filter",
  "wordpress_org": "https://wordpress.org/plugins/ajax-search-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ajax-search-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ajax-search-lite"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.14.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.14.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.14.6",
 "remediation": "Update to 4.14.6 or later.",
 "fix_released": "2026-10-14T08:56:49+00:00",
 "published": "2026-10-15T09:43:22+00:00",
 "updated": "2026-10-14T19:51:18.028603+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0993/",
  "https://plugins.svn.wordpress.org/ajax-search-lite/tags/4.14.6/",
  "https://wordpress.org/plugins/ajax-search-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ajax-search-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-15"
 }
}