Deserialization of untrusted data in the Ajax Search Lite plugin allows PHP Object Injection, which can lead to remote code execution on the host server. This weakness, identified as CWE-502, permits an attacker to craft malicious objects that, when deserialized, execute arbitrary PHP code, potentially compromising confidentiality, integrity, and availability of the affected website.

The vulnerability affects the wpdreams Ajax Search Lite WordPress plugin for all releases from the initial version through 4.13.3. Users running any of those versions are susceptible.

With a CVSS score of 5.5, the vulnerability is considered moderate severity. The EPSS score of less than 1% indicates a low likelihood of exploitation at present, and the issue is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is via the plugin's AJAX interface, where untrusted input is processed without proper validation.