{
 "id": "WPSEC-2026-1350",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1350/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1350/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1350/index.md",
 "title": "Ajax Search Lite <= 4.14.6 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Images",
 "description": "The Ajax Search Lite plugin for WordPress is vulnerable to Sensitive Information Exposure via search result images in all versions up to, and including, 4.14.6, due to the result image parser still reading the body of password-protected posts from the database, even though their content and excerpt are blanked in search results. When password-protected posts are included in search and the post content or excerpt is a result image source, this makes it possible for unauthenticated attackers to get the URL of images embedded in password-protected posts they do not have the password for.",
 "plugin": {
  "slug": "ajax-search-lite",
  "name": "Ajax Search Lite",
  "full_name": "Ajax Search Lite – Live Search & Filter",
  "wordpress_org": "https://wordpress.org/plugins/ajax-search-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ajax-search-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ajax-search-lite"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.14.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.14.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.14.7",
 "remediation": "Update to 4.14.7 or later.",
 "fix_released": "2026-10-19T09:32:08+00:00",
 "published": "2026-10-21T12:44:50+00:00",
 "updated": "2026-10-21T12:33:20.678437+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1350/",
  "https://plugins.svn.wordpress.org/ajax-search-lite/tags/4.14.7/",
  "https://wordpress.org/plugins/ajax-search-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ajax-search-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-21"
 }
}