An unauthenticated remote code execution vulnerability in the Ajax Search Lite WordPress plugin requires immediate updates to prevent full site compromise.

The plugin fails to securely handle untrusted input during deserialization (CWE-502). Unauthenticated attackers can leverage this flaw to trigger PHP object injection, which may result in remote code execution if a suitable POP chain is present.

A successful exploit allows an attacker to execute arbitrary code on the web server, leading to complete site takeover, unauthorized data access, and potential infection of other site visitors. The CVSS score of 9.8 reflects the high risk of total system compromise and the ease of exploitation by unauthenticated remote actors.

Immediate Action: Update the Ajax Search Lite plugin to version 4.14.5 or the latest available version immediately.

Proactive Monitoring: Monitor server access logs for unusual POST requests or serialized data strings that may indicate attempts to trigger deserialization vulnerabilities.

Compensating Controls: Utilize a Web Application Firewall (WAF) with rules designed to detect and block malicious serialized PHP objects to provide a temporary layer of protection.

Public Exploit Available: Unknown.

Given the critical nature of remote code execution vulnerabilities, site administrators should treat this as a high-priority update. Ensure that all plugins are kept up to date to minimize the attack surface and prevent exploitation of deserialization flaws.