CVE-2026-111852: Ajax Search Lite 4.14.6 Is Unauth Blind SQLi - Floor 4.14.7

CVE-2026-111852 is Patchstack’s name for an unauthenticated blind SQL injection in Ajax Search Lite (ajax-search-lite) through 4.14.6. They score it 9.3 critical (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). The CVE record went PUBLISHED on 21 October 2026; Patchstack’s datePublic is 19 October 2026. Finder credit: dzaku | Patchstack Bug Bounty Program. Floor: 4.14.7.[1][2]

The wordpress.org plugin API this morning returned version 4.14.7, active_installs 70000 (the directory’s 70k bucket), last updated 2026-10-19 9:54am GMT, tested to 7.1.3, requires WP 3.5 / PHP 7.4. Author profile: wpdreams. Plugin header on the 4.14.7 tag names Ernest Marcinko.[5][4]

Vendor changelog for 4.14.7: Fixed: Security issues, including an SQL injection through the search phrase reported by Patchstack CVE-2026-111852.[4]

What it is

This is CWE-89 in the Lite plugin on wordpress.org, not a WordPress core bug and not PHP2Shell.[1][2]

Patchstack’s CNA text: improper neutralization of SQL specials in Ajax Search Lite allows Blind SQL Injection, affected through 4.14.6, package ajax-search-lite. The CVSS vector is unauthenticated (PR:N), no user click (UI:N), scope changed, confidentiality high, integrity none, availability low.[1][2]

WPdreams’ own note is narrower than “any SQL anywhere”: they say the injection is through the search phrase. We did not dump the 4.14.6 query builder to name the PHP file. Treat “search phrase” as the vendor’s claim, not as a payload we ran.[4]

4.14.6 is not a clean build. That tag already listed other security work, including CVE-2026-110360 (non-public post types searchable without a login). This SQLi is a second floor: 4.14.6 still needs 4.14.7.[4]

The CVE product is Ajax Search Lite. It does not name Ajax Search Pro. Do not assume Pro is in or out of this ID without a Pro advisory - we did not inventory Pro source.[1]

How serious

A 9.3 with C:H and I:N is “the database can be read,” not “eval as www-data.” Blind SQLi is how you extract rows without seeing query output in the page. Hashes, emails, wp_options secrets, other tenants’ tables on a shared prefix - that is the confidentiality claim. It is not a claimed unauth RCE, plugin upload, or edit_user() chain.[1][2]

CISA’s SSVC row on the NVD object (timestamp 2026-10-21T15:27:42Z, role CISA Coordinator): exploitation: none, automatable: yes, technicalImpact: partial. That is CISA’s coordinator assessment on the NVD record, not a KEV listing.[2]

This CVE is not in CISA KEV as of catalog 2026.10.21 (dateReleased 2026-10-21T14:04:39.8983Z, 1754 entries). Newest dateAdded on that dump: 20 Oct Plex / SiteGuard / Siemens - not WordPress. Absence from KEV is not a clean bill of health; it means CISA has not listed confirmed in-the-wild under that program.[3]

Tenable mirrors the same CNA description and 9.3, and printed EPSS 0.00338 on the page we pulled this morning. EPSS is a model, not a hunt.[6]

NVD vulnStatus is Deferred. No NVD-assigned 3.1 of its own on the object we fetched - the 9.3 is Patchstack’s, type Secondary.[2]

Who is affected

In scope, per the CNA / NVD affected block:[1][2]

Any site with ajax-search-lite ≤ 4.14.6 active. No login required on the vector they published.
Abandoned copies stuck on 4.13.x / 4.12.x - the range is through 4.14.6, defaultStatus unaffected only from 4.14.7.
The live search bar is the product. If the plugin is installed and active, assume the search endpoint is reachable unless you have evidence it is not.

Out of scope unless you have a separate advisory:

The free plugin already on 4.14.7 (API version this morning).[5]
WordPress core.
Ajax Search Pro - not named in this CVE record.[1]

What to do now

Inventory the slug, not a theme screenshot.

# one site
wp plugin get ajax-search-lite --field=version --path=/home/USER/public_html
wp plugin list --name=ajax-search-lite --fields=name,status,version --path=/home/USER/public_html

# cPanel box, every account (read-only)
find /home -path '*/wp-content/plugins/ajax-search-lite/ajax-search-lite.php' 2>/dev/null \
  | while read -r f; do
      ver=$(awk -F': ' '/^[[:space:]]*\*?[[:space:]]*Version:/{print $2; exit}' "$f")
      echo "$ver  $f"
    done

Floor 4.14.7. The CNA solution line is: update to at least 4.14.7.[1][4]

wp plugin update ajax-search-lite --path=/home/USER/public_html
wp plugin get ajax-search-lite --field=version --path=/home/USER/public_html   # want 4.14.7 or later

If you cannot update today: deactivate. A WAF rule is not a version bump. There is no vendor-named “disable search AJAX only” switch in the changelog we read.[4]

wp plugin deactivate ajax-search-lite --path=/home/USER/public_html

Do not treat the patch as forensic cleanup. 4.14.7 stops this injection. It does not rewind a dump that already left. If access logs show search requests with SQL metacharacters at volume, rotate the DB user in wp-config.php, WordPress salts, and any API keys that lived in wp_options - then keep hunting. We are not claiming you were dumped.
Unsupported / frozen lines. Patchstack/NVD do not list 4.13.x or 4.12.x patched builds. The only unaffected change they published is 4.14.7. Jump a frozen 4.13 site through staging, or remove the plugin.[1][2]

Compromise signs

The published vector is read (C:H, I:N). Do not expect a new administrator as the signature of this CVE. Hunt for:[1][2]

Search/AJAX traffic with UNION, SLEEP(, information_schema, or stacked comments in the query string or POST body of the live-search endpoint.
MySQL slow-query / general log entries from the web user that are not normal title/LIKE searches.
Unexpected outbound bursts from php-fpm/lsphp after a search flood (exfil), if you have that telemetry.

Presence of SQL-shaped search traffic is a hunt target. Absence is not proof of cleanliness. We did not publish a Nuclei template and we did not send a probe.

FAQ

Is this PHP2Shell? No. PHP2Shell is CVE-2026-109618 / 109619 in PHP itself. This ID is a plugin SQL bug.[1]

Does 4.14.6 already “have the security fix”? It has other security fixes (CVE-2026-110360 and hardening listed in that tag). The search-phrase SQLi is called out on 4.14.7.[4]

Is it exploited? CISA SSVC on NVD says exploitation none as of 21 Oct 15:27 UTC. Not on KEV this morning. Tenable EPSS on the page we pulled is 0.00338. None of that is a guarantee it stays quiet.[2][3][6]

Can an attacker write the database with this CVE? The CNA vector sets integrity none. We are not upgrading that to RCE or admin-create without a second advisory.[1][2]

Honesty / What we could not verify

We did not exploit this. No search phrase was sent. No SLEEP() / UNION payload was run. No row was read.
We did not diff 4.14.6 vs 4.14.7 PHP. No svn client on this box; we did not walk src/server to name the prepared-statement change. Sink location is unverified here. Vendor text is “search phrase.”[4]
Patchstack’s HTML advisory 403’d (CloudFront) from this host. Claims above come from the CVE JSON, NVD 2.0, and the 4.14.7 readme - not from a Patchstack article body we never received.[1][2][4]
70,000 is wordpress.org active_installs this morning, not a census we ran.[5]
Ajax Search Pro is a different product. Not in this CVE’s affected block. Unverified.[1]
Not on CISA KEV as of catalog 2026.10.21 / count 1754.[3]
NVD status Deferred; 9.3 is Patchstack Secondary, not an NVD primary metric.[2]

Sources

[1] https://cveawg.mitre.org/api/cve/CVE-2026-111852 - CVE-2026-111852 CVE JSON (Patchstack CNA) [2] https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-111852 - NVD CVE-2026-111852 [3] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - CISA KEV catalog JSON [4] https://plugins.svn.wordpress.org/ajax-search-lite/tags/4.14.7/readme.txt - Ajax Search Lite 4.14.7 readme.txt [5] https://api.wordpress.org/plugins/info/1.2/?action=plugin_information&request%5Bslug%5D=ajax-search-lite - wordpress.org plugin API ajax-search-lite [6] https://www.tenable.com/cve/CVE-2026-111852 - Tenable CVE-2026-111852