---
id: "CVE-2026-61991"
kind: "vulnerability"
aliases: ["CVE-2026-61991"]
title: "AjaxLoadMore Cache WordPress plugin: unauthenticated code execution on servers"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "AjaxLoadMore Cache", "fixed": [], "affected": "<= 3.1.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["ajaxloadmore-cache", "package", "self-hosted", "unauthenticated", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-removed", "version-above-3.1.1"]
published_at: "2026-10-29T16:18:11+00:00"
first_seen_at: "2026-10-29T16:25:59+00:00"
updated_at: "2026-10-29T16:31:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61991", "first_seen_at": "2026-10-29T16:25:59+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:31:39+00:00"}]
---

# AjaxLoadMore Cache WordPress plugin: unauthenticated code execution on servers

The AjaxLoadMore Cache WordPress plugin up to version 3.1.1 contains an unauthenticated remote code execution flaw. An attacker who can reach the site can run code on the server without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:AjaxLoadMore Cache affected <= 3.1.1 fixed ?

## How to check

- Check the installed version of the AjaxLoadMore Cache plugin in the WordPress admin under Plugins; it is affected at `3.1.1` and earlier.
- Confirm whether the plugin is active on the site.

## Fix

No patched version known as of 2026-10-29 (Patchstack reports none). Until the vendor ships one, deactivate and delete the AjaxLoadMore Cache add-on, or use a WAF/Patchstack virtual patch.

## Timeline

- 2026-10-29T16:25:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61991
- 2026-10-29T16:31:39+00:00 analyst — Only third-party source found: Patchstack (13 Oct 2026) says <=3.1.1 unauth RCE, no official patch, reported 12 Sep 2026; Patchstack has a customer mitigation rule. No vendor (ajaxloadmore.com) advisory or fixed version found; no exploitation or PoC evidence seen. Nothing marked verified. Settle by vendor changelog for Cache add-on.

## Documents

- [advisory] Patchstack: AjaxLoadMore Cache <= 3.1.1 unauthenticated RCE https://patchstack.com/database/wordpress/plugin/ajax-load-more-cache/vulnerability/wordpress-ajaxloadmore-cache-plugin-3-1-1-remote-code-execution-rce-vulnerability

## From the sources

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_