Ajax Search Lite <= 4.14.6 - Unauthenticated SQL Injection via Search Phrase
- ID
- WPSEC-2026-1349
- Plugin
- Ajax Search Lite – Live Search & Filter (ajax-search-lite)
- Affected
- all versions before 4.14.7
- Remediation
- Update to 4.14.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-21
- Attack surface
- Ajax Search Lite on WPSec AttackSurface
- Fix released
- Published
Description
The Ajax Search Lite plugin for WordPress is vulnerable to SQL Injection via the search phrase in all versions up to, and including, 4.14.6, due to the search query's placeholder tokens being filled in with an array str_replace() call, which scans each inserted SQL fragment again for the later tokens. A phrase containing a token such as {like_query} therefore has a quoted SQL fragment inserted inside a string literal, which places the escaped phrase outside of any quotes. This makes it possible for unauthenticated attackers to append additional SQL queries to existing queries that can be used to extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-1349/
- https://plugins.svn.wordpress.org/ajax-search-lite/tags/4.14.7/
- https://wordpress.org/plugins/ajax-search-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS