Live › vulnerability › CVE-2026-61991
The AjaxLoadMore Cache WordPress plugin up to version 3.1.1 contains an unauthenticated remote code execution flaw. An attacker who can reach the site can run code on the server without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Any WordPress site running AjaxLoadMore Cache at version 3.1.1 or earlier is exposed, because the flaw needs no login. The sources do not say which configuration or plugin feature is required, so treat any site with the plugin installed as potentially exposed. Sites that have removed the plugin are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AjaxLoadMore Cache | wordpress | <= 3.1.1 | – |
3.1.1 and earlier.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-61991")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.