Cyber Posture

CVE-2025-48086

Medium

Published: 06 November 2025

Published
06 November 2025
Modified
27 April 2026
KEV Added
Patch
CVSS Score 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
EPSS Score 0.0005 16.2th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-48086 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Ajax Search Lite WordPress plugin developed by wpdreams, specifically within the ajax-search-lite component. This flaw enables Object Injection and affects all versions of the plugin up to and including 4.13.3. Published on 2025-11-06, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

The vulnerability can be exploited by unauthenticated remote attackers over the network with low attack complexity and no user interaction required. Exploitation allows attackers to achieve high impacts across confidentiality, integrity, and availability, consistent with the risks of PHP object injection in a WordPress context, such as potential remote code execution or data manipulation.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/ajax-search-lite/vulnerability/wordpress-ajax-search-lite-plugin-4-13-3-php-object-injection-vulnerability?_s_id=cve provides details on this PHP Object Injection vulnerability in Ajax Search Lite version 4.13.3. Security practitioners should consult this reference for recommended mitigation strategies.

Details

CWE(s)
CWE-502

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CVE-2025-48086 is a critical unauthenticated deserialization vulnerability (PHP Object Injection) in a public-facing WordPress plugin, directly enabling remote exploitation for potential RCE, mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References