The Ajax Search Lite plugin for WordPress suffers from a missing authorization check in its AJAX search handler, identified as CWE-862. This flaw allows unauthenticated attackers to perform repeated AJAX requests that can disclose the content of protected posts incrementally in 100-character windows. The vulnerability affects all versions up to and including 4.13.1. The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. There is no indication of integrity or availability impact. No patch or remediation details are currently available.

An attacker without authentication can exploit this vulnerability to leak partial content from protected posts on affected WordPress sites. This results in unauthorized disclosure of potentially sensitive information. The impact is limited to confidentiality, with no reported effects on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the AJAX search endpoint or disabling the Ajax Search Lite plugin if feasible to prevent unauthorized information disclosure.