{"id":"CVE-2026-61991","kind":"vulnerability","aliases":["CVE-2026-61991"],"related":[],"title":"AjaxLoadMore Cache WordPress plugin: unauthenticated code execution on servers","description":"Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.","summary":"The AjaxLoadMore Cache WordPress plugin up to version 3.1.1 contains an unauthenticated remote code execution flaw. An attacker who can reach the site can run code on the server without logging in.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AjaxLoadMore Cache","fixed":[],"affected":"<= 3.1.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["ajaxloadmore-cache","package","self-hosted","unauthenticated","wordpress","wordpress-plugin"],"not_affected_if":["plugin-removed","version-above-3.1.1"],"how_to_check":"- Check the installed version of the AjaxLoadMore Cache plugin in the WordPress admin under Plugins; it is affected at `3.1.1` and earlier.\n- Confirm whether the plugin is active on the site.","fix":"No patched version known as of 2026-10-29 (Patchstack reports none). Until the vendor ships one, deactivate and delete the AjaxLoadMore Cache add-on, or use a WAF/Patchstack virtual patch.","status":"open","published_at":"2026-10-29T16:18:11+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:27:07+00:00","updated_at":"2026-10-29T16:31:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:27:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AjaxLoadMore Cache WordPress plugin: unauthenticated code execution on servers","impact":"high","summary":"The AjaxLoadMore Cache WordPress plugin up to version 3.1.1 contains an unauthenticated remote code execution flaw. An attacker who can reach the site can run code on the server without logging in.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ajaxloadmore-cache","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs on the server without any login","analyst_note":"Sources give only the NVD summary; check the vendor changelog and a patched version number, and whether the flaw is exploited in the wild.","how_to_check":"- Check the installed version of the AjaxLoadMore Cache plugin in the WordPress admin under Plugins; it is affected at `3.1.1` and earlier.\n- Confirm whether the plugin is active on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-removed","version-above-3.1.1"],"who_is_affected":"Any WordPress site running AjaxLoadMore Cache at version 3.1.1 or earlier is exposed, because the flaw needs no login. The sources do not say which configuration or plugin feature is required, so treat any site with the plugin installed as potentially exposed. Sites that have removed the plugin are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000685,"input_tokens":4077,"output_tokens":555,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give only the NVD summary; check the vendor changelog and a patched version number, and whether the flaw is exploited in the wild.","search":"'-2026':11A,14A '-61991':12A,15A '3.1.1':38B,69C 'ajaxloadmor':1A,19B,31B,67C 'ajaxloadmore':16A 'ajaxloadmore-cach':18B 'attack':47B 'cach':2A,20B,32B,68C 'cache':17A 'code':6A,43B,55B,63C 'contain':39B 'cve':10A,13A 'execut':7A,44B,64C 'flaw':45B 'host':24B 'log':60B 'packag':21B 'plugin':4A,29B,34B 'rce':65C 'reach':50B 'remot':42B,62C 'run':54B 'self':23B 'self-host':22B 'server':9A,58B 'site':52B 'unauthent':5A,25B,41B,61C 'version':37B,70C 'without':59B 'wordpress':3A,26B,28B,33B 'wordpress-plugin':27B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running AjaxLoadMore Cache at version 3.1.1 or earlier is exposed, because the flaw needs no login. The sources do not say which configuration or plugin feature is required, so treat any site with the plugin installed as potentially exposed. Sites that have removed the plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61991","severity":null,"published_at":"2026-10-29T16:18:11+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-61991:1053","url":null,"severity":null,"published_at":"2026-10-29T16:31:39+00:00","modified_at":"2026-10-29T16:31:39+00:00","first_seen_at":"2026-10-29T16:31:39+00:00","fetched_at":"2026-10-29T16:31:39+00:00","note":"Only third-party source found: Patchstack (13 Oct 2026) says <=3.1.1 unauth RCE, no official patch, reported 12 Sep 2026; Patchstack has a customer mitigation rule. No vendor (ajaxloadmore.com) advisory or fixed version found; no exploitation or PoC evidence seen. Nothing marked verified. Settle by vendor changelog for Cache add-on."}],"documents":[{"id":17754,"url":"https://patchstack.com/database/wordpress/plugin/ajax-load-more-cache/vulnerability/wordpress-ajaxloadmore-cache-plugin-3-1-1-remote-code-execution-rce-vulnerability","title":"Patchstack: AjaxLoadMore Cache <= 3.1.1 unauthenticated RCE","kind":"advisory","source":"analyst","publisher":null,"text":"Patchstack, 13 Oct 2026: AjaxLoadMore Cache <= 3.1.1 unauthenticated RCE, CVSS 10, no official patch available, reported by Julieta 12 Sep 2026. Patchstack has a mitigation rule for its customers.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}