Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Ajax Search Lite plugin lets attackers read hidden database data

CVE-2026-111852 · published 14 days ago
Summary

The Ajax Search Lite add‑on for WordPress (versions up to 4.14.6) can be tricked into running hidden database queries. An attacker could use this to discover confidential information stored by your site. Update the plugin to the latest version or remove it if you cannot apply the update.

What to do
  • Update wpdreams ajax search lite to version 4.14.7.
Affected software
VendorProductAffected versions
wpdreams ajax search lite <= 4.14.6
Fix: upgrade to 4.14.7
Original advisory text
WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published21 Oct 2026
Updated4 Nov 2026
First seen21 Oct 2026
Sources
CVE-2026-111852 · NVD
CVE-2026-111852 · MITRE
Track software like this
Free during beta