CVE-2025-48086

Name of the Vulnerable Software and Affected Versions Ajax Search Lite versions prior to 4.13.4

Description An issue exists involving the deserialization of untrusted data, which allows for PHP Object Injection. This occurs when the software processes untrusted input, enabling authenticated attackers with administrator-level access or higher to inject a PHP Object. While no native POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software, the presence of a POP chain via other installed plugins or themes could allow an attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to a version newer than 4.13.3.