CVE-2026-28139 wpdreams CVE debrief

Who should care

Users of Ajax Search Lite plugin versions up to 4.14.4 should prioritize patching or mitigating this vulnerability. Operators, platform administrators, vulnerability management teams, and security teams should review the official advisory and plan for updates or compensating controls. Security teams should also monitor for suspicious activity and consider additional defensive measures.

Technical summary

CVE-2026-28139 is an unauthenticated PHP Object Injection vulnerability in Ajax Search Lite plugin versions up to 4.14.4. The vulnerability has a CVSS score of 9.8 and is considered CRITICAL. Affected product deployments should be identified and prioritized for patching or mitigation.

Defensive priority

Unauthenticated PHP Object Injection vulnerability in Ajax Search Lite plugin

Recommended defensive actions

• Inventory and version checks for Ajax Search Lite plugin
• Apply vendor-provided patches or updates
• Monitor for suspicious activity
• Consider compensating controls

Evidence notes

Evidence from official CVE and NVD sources indicate an unauthenticated PHP Object Injection vulnerability exists in Ajax Search Lite plugin versions up to 4.14.4. Limited details are available on affected products and versions. Defenders should verify the existence of affected product deployments, review official advisories, and plan for vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.