Missing authorization in wpdreams Ajax Search Lite – Live Search & Filter
Priority LOW 30CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of any protected post in rolling 100‑character windows.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00317 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-7956
- 2026-10-03 Alias added: GHSA-w36q-8ffj-6hq6
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/daa9c3dd-e8cf-4696-bc0c-4088509f89db?source=cve
- https://wordpress.org/plugins/ajax-search-lite/#developers
- https://plugins.trac.wordpress.org/browser/ajax-search-lite/tags/4.13.1/includes/classes/ajax/class-asl-search.php#L37
- https://plugins.trac.wordpress.org/changeset/3349881/
More wpdreams vulnerabilities
- TI-2023-01355 Ajax Search Lite Pro < 4.26.2 - Multiple Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2023-01343 Ajax Search Lite < 4.11.1, Pro < 4.26.2 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
- TI-2024-09790 Ajax Search Lite < 4.12.4 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.7
- TI-2024-07995 Ajax Search Lite <= 4.12.2 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2024-06563 Ajax Search Lite < 4.12.1 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2026-22480 WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-7956 · CVE Program
- CVE-2025-7956 · NVD
- FIRST EPSS
- GHSA-w36q-8ffj-6hq6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences