WPdreams Ajax Search Lite: Unauthenticated SQL injection (CVE-2026-111852)

Summary

The WordPress plugin Ajax Search Lite up to and including version 4.14.6 contains an SQL injection vulnerability that can be exploited without authentication. An attacker can send crafted requests to the plugin's search functionality to run blind SQL injection against the WordPress database. Successful exploitation may allow reading, modifying or deleting database content, including user accounts and private data. The CNA score is 9.3 (Critical), while other sources rate it lower (7.3 to 7.5); the NVD entry was still deferred at the time of review.

Affected

• WPdreams Ajax Search Lite (ajax-search-lite) WordPress plugin, all versions up to and including 4.14.6

Fixed in

• Update to version 4.14.7 or later

Workaround

• No vendor workaround known.
• Patchstack offers a virtual patch for its customers, which blocks attacks until the plugin is updated.
• If an update is not possible immediately, deactivate the plugin.

Exploitation

• No evidence of active exploitation known at the time of review; not listed in CISA KEV.
• No public proof-of-concept found.
• CISA SSVC: exploitation none, automatable yes.
• Patchstack expects exploitation, but this is a prediction, not evidence.

Our recommendation

• Inventory all WordPress sites using Ajax Search Lite, including hosting-managed installations.
• Update to version 4.14.7 or later immediately, or deactivate the plugin until the update is possible.
• Check web server logs for unusual admin-ajax.php requests and review the database for anomalies.
• If a vulnerable site was exposed, rotate database credentials and review administrator accounts.
• Keep the plugin updated, as it has had several other recent vulnerabilities.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE CVE-2026-111852 app.opencve.io
• WPScan Ajax Search Lite wpscan.com
• VulDB CVE-2026-111852 vuldb.com
• WordPress.org Ajax Search Lite plugin wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:00.