Auth bypass in Wpdreams Ajax Search Lite – Live & Filter
CVE-2025-7956
The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of any protected post in rolling 100‑character windows.
Vulnerability class: Broken Access Control
EPSS: 0.003 (20.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Wpdreams Ajax Search Lite – Live & Filter — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-7956?
- CVE-2025-7956 is a medium-severity vulnerability in Wpdreams Ajax Search Lite – Live & Filter, classified under Missing Authorization. CVSS score: 5.3/10. Published 2025-08-28.
- How severe is CVE-2025-7956?
- Medium severity. CVSS v3 base score is 5.3 out of 10.