CVE-2026-111852: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WPdreams Ajax Search Lite

This vulnerability in WPdreams Ajax Search Lite (versions >=0 and <4.14.7) is due to improper neutralization of special elements in SQL commands, enabling Blind SQL Injection. The flaw allows remote attackers with no privileges or user interaction to execute crafted SQL queries that can expose sensitive data (confidentiality impact is high) and cause limited denial of service (availability impact is low). The CVSS 3.1 score is 9.3, reflecting critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact) and partial denial of service (low availability impact). Integrity impact is not indicated. The vulnerability can be exploited remotely without authentication or user interaction.

No explicit patch or remediation link is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the vulnerable plugin or restricting access to mitigate risk.