The flaw is a missing authorization check in WPdreams Ajax Search Lite that allows requests to the plugin’s AJAX endpoint to be processed without verifying user credentials. This missing check falls under CWE‑862. The vulnerability description does not explicitly state that search results are exposed, but it indicates that unconfigured access control may permit unauthorized interaction with the search functionality. Based on the description, it is inferred that an attacker could gain access to data that should normally be restricted to authenticated users.

WordPress installations that have the WPdreams Ajax Search Lite plugin installed in any version up to and including 4.14.5, including the initial release through 4.14.5.

The CVSS score of 5.3 places the vulnerability in the moderate range. The EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, and there is no evidence of active exploitation. The likely attack vector is remote via HTTP requests to the plugin’s AJAX endpoint, as the flaw involves missing authorization on a web‑based API. Attacks would not require privileged access to the server, and any user who can reach the site could attempt to exercise the vulnerable endpoint.