# Ajax Search Lite <= 4.14.6 - Unauthenticated Sensitive Information Exposure via Password-Protected Post Images

- **ID:** WPSEC-2026-1350
- **Plugin:** Ajax Search Lite – Live Search & Filter (`ajax-search-lite`), https://wordpress.org/plugins/ajax-search-lite/
- **Affected versions:** all versions before 4.14.7
- **Fixed in:** 4.14.7 (Update to 4.14.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ajax-search-lite
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1350/

## Description

The Ajax Search Lite plugin for WordPress is vulnerable to Sensitive Information Exposure via search result images in all versions up to, and including, 4.14.6, due to the result image parser still reading the body of password-protected posts from the database, even though their content and excerpt are blanked in search results. When password-protected posts are included in search and the post content or excerpt is a result image source, this makes it possible for unauthenticated attackers to get the URL of images embedded in password-protected posts they do not have the password for.

## References

- https://wpsec.com/vuln/WPSEC-2026-1350/
- https://plugins.svn.wordpress.org/ajax-search-lite/tags/4.14.7/
- https://wordpress.org/plugins/ajax-search-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1350/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.