CVE-2026-61991: Unauthenticated RCE in AjaxLoadMore Cache

Critical unauthenticated RCE in AjaxLoadMore Cache WordPress plugin. CVSS 10.0. Versions <= 3.1.1.

CVE-2026-61991 is a critical unauthenticated Remote Code Execution vulnerability in WordPress plugin AjaxLoadMore Cache up to version 3.1.1. A remote attacker can execute arbitrary code on servers hosting WordPress sites using the plugin, without requiring any access credentials. CVSS reaches 10.0, the maximum on the scale, making this an immediate threat to any unpatched vulnerable installation.

The CVE was published on October 29, 2026, and within the next day already attracted public attention with 4 signals on X in the last 24 hours. Severity is confirmed as critical in the official source. According to available data, no official patch is yet available, leaving administrators exposed until the development team releases a security update.

IT and sysadmin teams must act immediately: verify whether AjaxLoadMore Cache plugin is installed on any managed WordPress site, check the version (vulnerable up to 3.1.1), and plan an update as soon as it becomes available. In the meantime, disabling or uninstalling the plugin if non-essential represents the most effective mitigation. Monitor official WordPress channels and plugin announcements for patch availability.

At a glance

What: Unauthenticated Remote Code Execution in WordPress plugin AjaxLoadMore Cache up to version 3.1.1. Remote attacker executes arbitrary code without credentials.
Severity: Critical. CVSS 10.0 (maximum on scale). No authentication or privilege requirements.
Affected versions: AjaxLoadMore Cache <= 3.1.1
Fix: Not reported. Official patch not yet available at time of NVD publication.
Status: Published October 29, 2026. Public visibility confirmed: 4 signals on X in 24 hours. No GitHub exploit reported.
Action: Immediately verify plugin installation on all WordPress sites. Check version (<=3.1.1 is vulnerable). Disable/uninstall if non-critical. Await official patch and apply urgently.

Sources: NVD, CVE-2026-61991

← All articles