The Ajax Search Lite WordPress plugin prior to version 4.14.5 does not properly prevent deserialization of untrusted input. This flaw enables unauthenticated attackers to perform PHP Object Injection. When combined with a suitable POP (Property Oriented Programming) chain available via another installed Ajax Search Lite plugin before 4.14.5 or potentially other plugins, this vulnerability can be exploited to achieve remote code execution on the affected system. The vulnerability is tracked as CVE-2026-16258 and classified under CWE-502.

Successful exploitation allows unauthenticated attackers to execute arbitrary code remotely on the affected WordPress site. This can lead to full system compromise, including data theft, site defacement, or further attacks within the hosting environment. The CVSS score of 9.8 reflects the critical nature of this vulnerability with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a patch is available, consider disabling or removing the Ajax Search Lite plugin if feasible, or applying other protective measures recommended by the vendor.