CVE-2025-48086
Published: 06 November 2025
Summary
CVE-2025-48086 is a medium-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-48086 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Ajax Search Lite WordPress plugin developed by wpdreams, specifically within the ajax-search-lite component. This flaw enables Object Injection and affects all versions of the plugin up to and including 4.13.3. Published on 2025-11-06, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
The vulnerability can be exploited by unauthenticated remote attackers over the network with low attack complexity and no user interaction required. Exploitation allows attackers to achieve high impacts across confidentiality, integrity, and availability, consistent with the risks of PHP object injection in a WordPress context, such as potential remote code execution or data manipulation.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/ajax-search-lite/vulnerability/wordpress-ajax-search-lite-plugin-4-13-3-php-object-injection-vulnerability?_s_id=cve provides details on this PHP Object Injection vulnerability in Ajax Search Lite version 4.13.3. Security practitioners should consult this reference for recommended mitigation strategies.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-38020
Vulnerability details
Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-48086 is a critical unauthenticated deserialization vulnerability (PHP Object Injection) in a public-facing WordPress plugin, directly enabling remote exploitation for potential RCE, mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the deserialization flaw in Ajax Search Lite versions <=4.13.3, directly eliminating the object injection vulnerability.
Mandates validation of untrusted inputs to the ajax-search-lite component, blocking malicious data that enables PHP object injection.
Vulnerability scanning identifies the presence of the vulnerable Ajax Search Lite plugin, enabling proactive patching before exploitation.