PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111852 WPdreams CVE debrief

The CVE-2026-111852 vulnerability is a SQL Injection issue in the WordPress Ajax Search Lite plugin versions up to 4.14.6. This vulnerability allows for Blind SQL Injection, posing a critical risk to affected systems. The vulnerability impacts database confidentiality and integrity, and defenders should assess exposure and prioritize mitigation efforts. The CVSS score is 9.3, indicating a critical severity level. The CVE record and source item provide details on the SQL Injection vulnerability in the WordPress Ajax Search Lite plugin. The vendor, WPdreams, has provided information on the affected version (up to 4.14.6) and the fix in version 4.14.7. Defenders should verify patching

Vendor
WPdreams
Product
Ajax Search Lite
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-21
Advisory published
2026-10-21
Advisory updated
2026-10-21

Who should care

Defenders responsible for WordPress installations with the Ajax Search Lite plugin should assess exposure and prioritize mitigation due to the critical severity of this SQL Injection vulnerability.

Why it matters

The CVE-2026-111852 SQL Injection vulnerability in the WordPress Ajax Search Lite plugin poses a critical risk to affected systems, requiring immediate attention from defenders. The vulnerability allows for Blind SQL Injection attacks, potentially impacting database confidentiality and integrity. Defenders responsible for WordPress installations with the Ajax Search Lite plugin should assess exposure and prioritize mitigation efforts.

  • Potential for Blind SQL Injection attacks, allowing unauthorized access to sensitive data.
  • Critical severity level (CVSS score of 9.3) indicates a high risk to affected systems.
  • Possible impact on database confidentiality and integrity.
  • Requires verification of patching or mitigation efforts to prevent exploitation.

Technical summary

The CVE-2026-111852 vulnerability is a SQL Injection issue in the WordPress Ajax Search Lite plugin versions up to 4.14.6. This vulnerability allows for Blind SQL Injection, posing a critical risk to affected systems. The CVSS score is 9.3, indicating a critical severity level.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability as soon as possible due to its critical severity and potential for Blind SQL Injection attacks.

Recommended defensive actions

  • Patch or upgrade the WordPress Ajax Search Lite plugin to version 4.14.7 or later.
  • Implement Web Application Firewall (WAF) rules to detect and prevent SQL Injection attacks.
  • Monitor database activity for suspicious queries.
  • Perform regular vulnerability scans and penetration testing to identify potential issues.

Evidence notes

The CVE record and source item provide details on the SQL Injection vulnerability in the WordPress Ajax Search Lite plugin. The vendor, WPdreams, has provided information on the affected version (up to 4.14.6) and the fix in version 4.14.7.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111852 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111852

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111852 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111852

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.