PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-28139 wpdreams CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T15:16:52.580Z and has not been modified since then. CVE-2026-28139 is an unauthenticated PHP Object Injection vulnerability in Ajax Search Lite plugin versions up to 4.14.4. The vulnerability has a CVSS score of 9.8 and is considered CRITICAL. Affected product deployments should be identified and prioritized for patching or mitigation. Users of Ajax Search Lite plugin versions up to 4.14.4 should prioritize patching or mitigating this vulnerability. Operators, platform administrators, vulnerability management teams, and security teams should review the official advisory and plan for updates or compensating controls. Security teams should also monitor for suspicious activity and consider additional defensive measures. Evidence from official CVE and NVD sources indicate an unauthenticated PHP Object Injection vulnerability exists in Ajax Search Lite plugin versions up to 4.14.4. Limited details are available on affected products and versions. Defenders should verify the existence of affected product deployments, review official advisories, and plan for vendor-supported updates or mitigations.

Vendor
wpdreams
Product
Ajax Search Lite
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-06
Original CVE updated
2026-08-06
Advisory published
2026-08-06
Advisory updated
2026-08-06

Who should care

Users of Ajax Search Lite plugin versions up to 4.14.4 should prioritize patching or mitigating this vulnerability. Operators, platform administrators, vulnerability management teams, and security teams should review the official advisory and plan for updates or compensating controls. Security teams should also monitor for suspicious activity and consider additional defensive measures.

Technical summary

CVE-2026-28139 is an unauthenticated PHP Object Injection vulnerability in Ajax Search Lite plugin versions up to 4.14.4. The vulnerability has a CVSS score of 9.8 and is considered CRITICAL. Affected product deployments should be identified and prioritized for patching or mitigation.

Defensive priority

Unauthenticated PHP Object Injection vulnerability in Ajax Search Lite plugin

Recommended defensive actions

  • Inventory and version checks for Ajax Search Lite plugin
  • Apply vendor-provided patches or updates
  • Monitor for suspicious activity
  • Consider compensating controls

Evidence notes

Evidence from official CVE and NVD sources indicate an unauthenticated PHP Object Injection vulnerability exists in Ajax Search Lite plugin versions up to 4.14.4. Limited details are available on affected products and versions. Defenders should verify the existence of affected product deployments, review official advisories, and plan for vendor-supported updates or mitigations.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T15:16:52.580Z and has not been modified since then.