Vulnerability · Published Aug 28, 2025 · Assigned by Wordfence
CVE-2025-7956Ajax Search Lite <= 4.13.1 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handler
Medium 5.3
In plain English
A medium-severity missing authorization in Ajax Search Lite – Live Search & Filter from wpdreams. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of any protected post in rolling 100‑character windows.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpdreams | Ajax Search Lite – Live Search & Filter | 0 – through 4.13.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/daa9c3dd-e8cf-4696-bc0c-4088509f89db?source=cve
- https://wordpress.org/plugins/ajax-search-lite/#developers
- https://plugins.trac.wordpress.org/browser/ajax-search-lite/tags/4.13.1/includes/classes/ajax/class-asl-search.php#L37
- https://plugins.trac.wordpress.org/changeset/3349881/