# Ajax Search Lite <= 4.14.5 - Unauthenticated Sensitive Information Exposure of Password Protected Post Content via Search Results

- **ID:** WPSEC-2026-0993
- **Plugin:** Ajax Search Lite – Live Search & Filter (`ajax-search-lite`), https://wordpress.org/plugins/ajax-search-lite/
- **Affected versions:** all versions before 4.14.6
- **Fixed in:** 4.14.6 (Update to 4.14.6 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ajax-search-lite
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0993/

## Description

The Ajax Search Lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.14.5. When the 'Search and return password protected posts' option is enabled, the live search matches and returns the content and excerpt of password protected posts without checking whether the visitor entered the post password. This makes it possible for unauthenticated attackers to read the protected body of such posts. This is an incomplete fix of CVE-2025-7956, which only made the option disabled by default.

## References

- https://wpsec.com/vuln/WPSEC-2026-0993/
- https://plugins.svn.wordpress.org/ajax-search-lite/tags/4.14.6/
- https://wordpress.org/plugins/ajax-search-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0993/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.