CVE-2025-48086
Published: 06 November 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-48086 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Ajax Search Lite WordPress plugin developed by wpdreams, specifically within the ajax-search-lite component. This flaw enables Object Injection and affects all versions of the plugin up to and including 4.13.3. Published on 2025-11-06, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
The vulnerability can be exploited by unauthenticated remote attackers over the network with low attack complexity and no user interaction required. Exploitation allows attackers to achieve high impacts across confidentiality, integrity, and availability, consistent with the risks of PHP object injection in a WordPress context, such as potential remote code execution or data manipulation.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/ajax-search-lite/vulnerability/wordpress-ajax-search-lite-plugin-4-13-3-php-object-injection-vulnerability?_s_id=cve provides details on this PHP Object Injection vulnerability in Ajax Search Lite version 4.13.3. Security practitioners should consult this reference for recommended mitigation strategies.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CVE-2025-48086 is a critical unauthenticated deserialization vulnerability (PHP Object Injection) in a public-facing WordPress plugin, directly enabling remote exploitation for potential RCE, mapping to T1190: Exploit Public-Facing Application.