CVE-2026-28139

Executive Summary

CVE-2026-28139 is a critical unauthenticated PHP Object Injection vulnerability affecting the WordPress Ajax Search Lite plugin in all versions up to and including 4.14.4. This flaw allows a remote attacker with no authentication and no user interaction to exploit insecure deserialization of user-controlled data, potentially leading to full arbitrary code execution, file read/write, or database compromise on the target WordPress instance. The vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and complete impact on confidentiality, integrity, and availability. Any WordPress site running Ajax Search Lite version 4.14.4 or earlier is affected and should prioritize patching.

Technical Analysis

CVE-2026-28139 is classified under CWE-502 (Deserialization of Untrusted Data). The Ajax Search Lite plugin, developed for WordPress to provide AJAX-based live search functionality, fails to properly sanitize or validate serialized PHP data received from user input before passing it to a PHP deserialization function (e.g., unserialize()).

The vulnerability mechanism is as follows:

1. Trigger Point: The plugin processes certain HTTP request parameters (likely within its AJAX search handler) that contain serialized PHP objects. These parameters are passed to a native unserialize() call without adequate filtering.

2. PHP Object Injection: When an attacker supplies a crafted serialized payload, PHP's deserialization process instantiates the specified class objects. If the application has magic methods (__wakeup(), __destruct(), __toString(), __call()) present in loaded classes, these can be used as a gadget chain to perform malicious actions.

3. Gadget Chain: While the plugin itself may not contain a full gadget chain, WordPress core and other commonly installed plugins/themes often include classes with exploitable magic methods (e.g., WP_Query, Requests_Cookie, or logging classes) that can be chained to achieve Remote Code Execution (RCE) via arbitrary file writing or command execution.

4. Authentication Bypass: The NVD description explicitly states the vulnerability is "Unauthenticated," meaning no valid user session or API key is required to reach the vulnerable code path. The AJAX handler in question does not enforce capability checks.

5. Attack Surface: The attack surface is the WordPress REST API and/or the admin-ajax.php endpoint, both of which are publicly accessible on any standard WordPress installation. The plugin registers its AJAX actions as public (nopriv) handlers.

Code-level specifics (function names and file paths) are not disclosed in the CVE metadata; however, the class of vulnerability is well-understood. The injection point accepts POST or GET parameters, deserializes them, and the resulting objects trigger side effects via destructors or other magic methods during garbage collection or script termination.

Exploitation Scenarios

Even in the absence of a publicly disclosed PoC, the exploitation chain for CVE-2026-28139 follows the well-established pattern for PHP Object Injection in WordPress plugins:

Step 1 — Reconnaissance (Target Identification) The attacker identifies WordPress sites running Ajax Search Lite via:

• Using Shodan queries (e.g., http.title:"Ajax Search Lite") to discover sites exposing the plugin.
• Running WordPress scanner tools (e.g., WPScan) to fingerprint plugin versions by reading the plugin's readme.txt file (often accessible at /wp-content/plugins/ajax-search-lite/readme.txt).
• Browsing site source code to detect Ajax Search Lite's generated HTML/CSS identifiers.

Step 2 — Crafting the Payload The attacker builds a serialized PHP object chain that, upon deserialization, exploits a known WordPress gadget:

• Example payload structure: O:8:"WP_Query":1:{s:14:"query_vars_hash";...} or a chain targeting Requests_Cookie to write a PHP webshell to disk.
• The payload is URL-encoded and appended to the vulnerable AJAX action parameter.

Step 3 — Trigger (Request Injection) The attacker sends an HTTP request to the vulnerable endpoint:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

action=ajax_search_lite_handler&data=<URL-ENCODED-SERIALIZED-PAYLOAD>

Alternatively:

GET /?rest_route=/ajax-search-lite/v1/search&data=<PAYLOAD>

The server processes the request, passes the serialized data to unserialize(), and the object chain executes.

Step 4 — Payload Execution Depending on the gadget chain:

• If chained to Requests_Cookie or similar file-writing gadgets, the attacker achieves arbitrary file write. They can write a PHP web shell to the web root (e.g., /wp-content/uploads/evil.php).
• Alternatively, the object's __destruct() method may trigger eval() or system() calls if a suitable gadget exists in installed plugins.

Step 5 — Post-Exploitation With a web shell or RCE established:

• The attacker gains full control of the WordPress application and web server process.
• They may read wp-config.php to extract database credentials, then access the database directly.
• They can install backdoor plugins, modify site content, deface the site, or pivot to the underlying operating system.
• In a shared hosting environment, the attacker may attempt privilege escalation to access other hosted sites.

Additional Scenario — Data Exfiltration If the attacker cannot achieve RCE (due to hardened PHP settings), the object injection may still enable arbitrary file reads via phar:// streams or trigger SQL injection through deserialized objects, enabling database exfiltration of password hashes and sensitive user data.

Impact Assessment

Business Impact: This is a critical, trivially exploitable vulnerability. With a CVSS base score of 9.8 (Critical), the vector indicates:

• Attack Vector (AV:N): Remotely exploitable over the network.
• Attack Complexity (AC:L): No special conditions required; the Attack complexity is low.
• Privileges Required (PR:N): No authentication needed.
• User Interaction (UI:N): No victim interaction required.

Confidentiality (C:H), Integrity (I:H), Availability (A:H): Successful exploitation yields complete control, allowing full data disclosure, modification of all site content and code, and denial of service.

Affected Systems: All WordPress installations using Ajax Search Lite ≤ 4.14.4. This plugin is popular for e-commerce sites, blogs, and business websites seeking live search functionality.

Blast Radius:

• Complete website takeover and defacement.
• Exfiltration of customer PII, payment data, and credentials.
• Lateral movement if the hosting environment or server has network access to internal resources.
• Malware distribution via a compromised site (SEO poisoning, drive-by downloads).
• Reputational damage and potential regulatory fines (GDPR, CCPA) for data breaches.
• The "scope unchanged" (S:U) means the compromised component (plugin/WordPress) does not necessarily grant access to other infrastructure, but RCE often leads to a full server compromise regardless.

Exploitability Assessment: High. This vulnerability class (PHP Object Injection in WordPress plugins) is frequently weaponized within days of disclosure. Automated scanning tools can trivially detect and exploit it.

Detection Guidance

Sigma Rule

title: CVE-2026-28139 - Ajax Search Lite PHP Object Injection Attempt
id: 4f7a3c2e-8b6d-4e1a-9f2b-1c3d5e7a9b0c
status: experimental
description: Detects HTTP requests containing serialized PHP object payloads targeting the Ajax Search Lite WordPress plugin.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-28139
author: SOC Team
date: 2026/05/01
logsource:
    category: webserver
    product: apache
    definition: Web server access logs or reverse proxy logs.
detection:
    selection_ajx_action:
        c-uri|contains:
            - '/admin-ajax.php'
            - '/?rest_route='
    selection_payload:
        cs-method: POST
        c-uri|contains|all:
            - 'action='
        c-uri|contains|any:
            - 'ajax_search_lite'
            - 'asl_'
    selection_php_objects:
        # Match serialized object patterns: O:<digit>:... or a:... with object-ish structure
        c-uri|contains|any:
            - 'O%3A%'
            - 'O:'
            - 's%3A%'
            - 'i%3A%'
        c-uri|re: '((O|a|s|i):\\d+:|%2[357]:)'
    condition: selection_ajx_action and selection_payload and selection_php_objects
falsepositives:
    - Legitimate plugin functionality that uses serialized data for search options
level: high

YARA Rule

rule CVE_2026_28139_Ajax_Search_Lite_PHP_Object_Injection {
    meta:
        author = "SOC Threat Intel"
        description = "Detects serialized PHP object payloads targeting Ajax Search Lite WordPress plugin"
        date = "2026-05-01"
        cve = "CVE-2026-28139"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-28139"
        score = 80
    strings:
        // AJAX action identifiers for the plugin
        $ajax_action = /(action=ajax_search_lite|action=asl_|ajax-search-lite)/
        $rest_route = /rest_route=
        
        // PHP serialized object patterns
        $ser_obj = /O:[0-9]+:"[^"]+":[0-9]+:/
        $ser_arr = /a:[0-9]+:\{/
        $ser_str = /s:[0-9]+:"/
        
        // Common gadget class names (WordPress core/chains)
        $gadget_wp_query = "WP_Query"
        $gadget_requests = "Requests_Cookie"
        $gadget_php_std = "PHP_StdClass"  // 'SplStack', 'SplDoublyLinkedList'
        
    condition:
        uint16(0) == 0x0d0a and  // MZ header skip, check HTTP data
        (($ajax_action or $rest_route) and 
        ($ser_obj or $ser_arr) and 
        ($gadget_wp_query or $gadget_requests or $gadget_php_std))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-28139 - Ajax Search Lite PHP Object Injection Attempt";
    flow:established,to_server;
    http.method; content:"POST";
    http.uri; content:"/admin-ajax.php"; nocase;
    http.uri; content:"action="; distance:0;
    http.uri; pcre:"/action=(ajax_search_lite|asl_)/i";
    http.uri; pcre:"/(O|a|s|i):[0-9]+:/";
    http.uri; content:"O%3A"; nocase;
    sid:2813901; rev:1;
    reference:cve,2026-28139;
    classtype:attempted-admin;
    metadata:created_at 2026_05_01, updated_at 2026_05_01;
)

Elastic Detection

// EQL Query for Elastic Security
sequence by source.ip
  with maxspan=30s
  [ network where event.type == "connection" and network.protocol == "http" and
    destination.port == 80 or destination.port == 443
  ]
  [ http where event.category == "web" and http.request.method == "POST" and
    url.path == "/wp-admin/admin-ajax.php" and
    url.query contains "action=" and url.query matches "action=(ajax_search_lite|asl_)" and
    (
      url.query contains "O:" or
      url.query contains "O%3A" or
      url.query contains "a:" and url.query matches "a:[0-9]+:" or
      url.query contains "s:" and url.query matches "s:[0-9]+:"
    )
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST"
| regex uri="/wp-admin/admin-ajax\.php"
| regex uri="action=(ajax_search_lite|asl_)"
| regex uri="(O%3A|O:|a:[0-9]+:|s:[0-9]+:|i:[0-9]+:)"
| stats count by src_ip, uri, http_user_agent
| sort - count
| table _time, src_ip, uri, http_user_agent, count

Wazuh OSSEC Rule

<group name="web, wordpress, cve-2026-28139,">
    <rule id="281391" level="15">
        <decoded_as>json</decoded_as>
        <field name="url">/wp-admin/admin-ajax.php</field>
        <field name="method">POST</field>
        <regex>action=(ajax_search_lite|asl_)</regex>
        <regex>(O%3A|O:|a:[0-9]+:|s:[0-9]+:)</regex>
        <description>CVE-2026-28139: Ajax Search Lite PHP Object Injection exploitation attempt</description>
        <group>attack, exploitation, cve-2026-28139</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: The CNA (Patchstack) claims a patched version 4.14.5 exists. However, patch confidence is rated 2/4 (CLAIMED), meaning the fix is reported by a single source and not yet independently confirmed. Always verify the patch is genuine by checking the plugin's official changelog and downloading from the WordPress.org repository or a trusted vendor channel.

Immediate Mitigations (if patch cannot be applied immediately):

1. Disable the plugin: Deactivate and delete the Ajax Search Lite plugin from all WordPress installations until the patch is verified and applied. This is the only guaranteed mitigation, as no workarounds are documented.
2. Web Application Firewall (WAF) rules: Deploy custom WAF rules (using the Sigma/Suricata patterns above) to inspect incoming HTTP requests for serialized PHP objects in AJAX parameters targeting this plugin. Block requests matching action=(ajax_search_lite|asl_) with serialized payload patterns.
3. Server-side input validation: If the plugin cannot be disabled, configure server-level request filtering (e.g., ModSecurity rules) to reject POST/PUT data containing the pattern O:[0-9]+:" in parameters associated with the plugin.
4. Network-level blocking: Restrict access to /wp-admin/admin-ajax.php to only trusted IP ranges, although this may impact legitimate functionality.

Patch/Upgrade Steps:

1. Log in to the WordPress admin dashboard.
2. Navigate to Plugins → Installed Plugins.
3. Locate "Ajax Search Lite."
4. Check the plugin version. If version is ≤ 4.14.4, click "Update Now" to upgrade to version 4.14.5 or later.
5. If the plugin is not auto-updating, manually download the latest package from WordPress.org or the vendor's site, then upload via "Add New Plugin" → "Upload Plugin."
6. After updating, verify the version number shows ≥ 4.14.5.
7. Even after patching, assume the site may have been compromised if it was exposed to untrusted traffic. Run a malware scan, audit admin users, and check for suspicious files in the web root and upload directories.

Long-Term Hardening:

1. Enable automatic updates for all WordPress plugins and core.
2. Least privilege: Use a dedicated service account with limited filesystem permissions for the web server process to minimize blast radius of RCE.
3. Security plugin: Install a WordPress security plugin (e.g., Wordfence, Sucuri) that provides virtual patching and blocks known exploit patterns.
4. Regular backups: Maintain off-site, immutable backups to facilitate recovery.
5. Hardening: Disable PHP's unserialize() for untrusted input at the application level (if feasible), or use json_decode instead where plugin code can be modified.
6. Continuous monitoring: Implement the detection rules above in your SIEM/EDR (Elastic, Splunk, Wazuh) and ensure logs from web servers are retained for at least 90 days.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-28139 — Official National Vulnerability Database record with CVSS vector and description.
2. Patchstack Advisory: https://patchstack.com/database/vulnerability/ajax-search-lite — Vendor security advisory (source of the CVE claim and patch information).
3. CWE-502 Reference: https://cwe.mitre.org/data/definitions/502.html — Common Weakness Enumeration for deserialization of untrusted data.
4. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Technique reference for Exploit Public-Facing Application.
5. CISA KEV: Not applicable — This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog at the time of writing.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of this report, no active campaigns exploiting CVE-2026-28139 have been publicly documented. The EPSS (Exploit Prediction Scoring System) has not yet scored this vulnerability, and no public PoC or Nuclei template has been released. However, the historical pattern for similar unauthenticated PHP Object Injection vulnerabilities in WordPress plugins (e.g., CVE-2021-24272 in various plugins) shows rapid weaponization, often within 24-72 hours of disclosure. It is strongly recommended to treat this as an actively exploitable threat and patch immediately.