CVE-2025-7956: Ajax Search Lite Information Disclosure

CVE-2025-7956 Overview

CVE-2025-7956 affects the Ajax Search Lite plugin for WordPress in all versions up to and including 4.13.1. The plugin's AJAX search handler fails to enforce authorization checks, allowing unauthenticated attackers to query protected post content through the search endpoint. By issuing repeated AJAX requests, an attacker can reconstruct the content of any protected post in rolling 100-character windows. The weakness is classified as CWE-862: Missing Authorization and is exploitable over the network without user interaction.

Critical Impact
Unauthenticated attackers can leak the full content of password-protected and private WordPress posts by iterating AJAX search requests against affected sites.

Affected Products

WordPress Ajax Search Lite plugin versions up to and including 4.13.1
WordPress sites using the plugin with password-protected or private posts
Any WordPress deployment exposing the wp-admin/admin-ajax.php search action to unauthenticated users

Discovery Timeline

2025-08-28 - CVE-2025-7956 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7956

Vulnerability Analysis

The Ajax Search Lite plugin registers an AJAX search action that queries the WordPress posts table and returns matched excerpts to the caller. In vulnerable versions the handler defined in includes/classes/ajax/class-asl-search.php does not verify whether the requesting user has permission to view the matched posts. Because WordPress returns match context around the search term, an attacker who searches for successive character sequences receives back short windows of the underlying post content. Iterating this behavior across the character space allows reconstruction of protected content that should be gated by post visibility settings.

The issue is a confidentiality flaw only. It does not modify data or affect site availability, but it defeats WordPress post-level access controls that site owners rely on for private, draft, and password-protected content.

Root Cause

The root cause is missing authorization inside the AJAX search callback. The handler treats all posts equally when building the response, ignoring post_status and post_password gates. WordPress capability checks such as current_user_can( 'read_private_posts' ) and password-cookie validation are not applied before excerpts are returned to the client.

Attack Vector

An unauthenticated attacker sends crafted POST requests to wp-admin/admin-ajax.php targeting the plugin's search action. Each request supplies a partial string; the server responds with matching excerpts that include roughly 100 characters of surrounding post content. By walking search terms character-by-character or word-by-word, the attacker stitches together the full body of protected posts. See the plugin source at the vulnerable revision and the Wordfence vulnerability report for technical details.

Detection Methods for CVE-2025-7956

Indicators of Compromise

High-volume POST requests to /wp-admin/admin-ajax.php with the Ajax Search Lite action parameter from a single source address
Sequential search queries that iterate through short, incrementing character strings within a narrow time window
Requests originating from unauthenticated sessions that return response bodies containing excerpts of private or password-protected posts

Detection Strategies

Parse web server access logs for repeated admin-ajax.php calls tied to the plugin's search action and correlate by client IP and user agent
Alert on unauthenticated AJAX search traffic exceeding a baseline threshold, particularly when queries share incremental prefixes
Inventory WordPress installations to identify sites running Ajax Search Lite <= 4.13.1

Monitoring Recommendations

Forward WordPress and reverse-proxy access logs to a centralized analytics platform for query-pattern analysis
Monitor egress volumes from the admin-ajax.php endpoint to detect scraping-style enumeration
Track plugin versions across managed WordPress fleets and flag hosts pinned to vulnerable releases

How to Mitigate CVE-2025-7956

Immediate Actions Required

Update the Ajax Search Lite plugin to the version released in changeset 3349881 or later, which adds the missing authorization checks
Audit protected posts that may have been exposed and rotate any sensitive content such as embedded credentials, links, or coupon codes
Restrict access to wp-admin/admin-ajax.php at the web application firewall until patching is complete

Patch Information

The plugin author corrected the missing authorization in the search handler; see the WordPress changeset log and the plugin developer page for release notes. Site operators should upgrade to the fixed version above 4.13.1.

Workarounds

Deactivate and remove the Ajax Search Lite plugin until an upgrade is applied
Block or rate-limit unauthenticated requests to the plugin's AJAX action at a WAF or reverse proxy
Remove sensitive material from password-protected posts and store it in access-controlled systems while remediation is in progress

bash

# Example WAF rule fragment to rate-limit unauthenticated Ajax Search Lite requests
# (adapt to your WAF syntax; illustrative only)
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "ajaxsearchlite_search") {
        limit_req zone=asl_search burst=5 nodelay;
    }
}