# Ajax Search Lite <= 4.14.6 - Unauthenticated SQL Injection via Search Phrase

- **ID:** WPSEC-2026-1349
- **Plugin:** Ajax Search Lite – Live Search & Filter (`ajax-search-lite`), https://wordpress.org/plugins/ajax-search-lite/
- **Affected versions:** all versions before 4.14.7
- **Fixed in:** 4.14.7 (Update to 4.14.7 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ajax-search-lite
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1349/

## Description

The Ajax Search Lite plugin for WordPress is vulnerable to SQL Injection via the search phrase in all versions up to, and including, 4.14.6, due to the search query's placeholder tokens being filled in with an array str_replace() call, which scans each inserted SQL fragment again for the later tokens. A phrase containing a token such as {like_query} therefore has a quoted SQL fragment inserted inside a string literal, which places the escaped phrase outside of any quotes. This makes it possible for unauthenticated attackers to append additional SQL queries to existing queries that can be used to extract sensitive information from the database.

## References

- https://wpsec.com/vuln/WPSEC-2026-1349/
- https://plugins.svn.wordpress.org/ajax-search-lite/tags/4.14.7/
- https://wordpress.org/plugins/ajax-search-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1349/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.