An unauthenticated PHP object injection vulnerability in the Ajax Search Lite plugin exposes WordPress sites to complete takeover by remote attackers.

This is a deserialization of untrusted data vulnerability (CWE-502) occurring within the plugin. Because it is unauthenticated, any remote attacker can submit crafted input to the application, triggering the injection and potential execution of arbitrary code on the underlying server.

The vulnerability carries a CVSS score of 9.8, reflecting the high probability of full system compromise. An attacker could gain remote code execution, allowing them to install backdoors, steal sensitive user data, or modify website content, causing significant reputational damage and operational disruption.

Immediate Action: Update the Ajax Search Lite plugin to version 4.14.5 or later immediately.

Proactive Monitoring: Review web server logs for suspicious POST requests containing serialized PHP objects or anomalous patterns targeting the plugin's search functionality.

Compensating Controls: Implement a Web Application Firewall with rules designed to detect and block malicious deserialization attempts or common PHP object injection payloads.

Public Exploit Available: No

Given the ease of exploitation and the high severity of the vulnerability, all administrators must prioritize updating the Ajax Search Lite plugin. If an update cannot be performed immediately, the plugin should be deactivated until a secure version is deployed.