External risk intelligence

Ajax Load More Cache Unauthenticated RCE Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-61991

The vulnerability affects a WordPress plugin, which is typically deployed as part of a public-facing web application. Since web plugins are designed to enhance the functionality of internet-accessible websites, they are commonly exposed to the public internet by default in standard deployment patterns.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Ajax Load More Cache allows unauthenticated attackers to execute arbitrary code remotely on affected systems. This type of flaw, particularly when it enables remote code execution without requiring any authentication, presents a significant security risk to any online service or application utilizing this plugin. The main concern is confirming relevance and exposure to this specific plugin.

Unauthenticated remote code execution is a critical flaw.
It impacts widely used web plugins.
Confirm relevance and exposure to the affected plugin.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a vulnerable server over the network. This request targets the AjaxLoadMore Cache component, leading to unauthenticated remote code execution. The attacker does not need any special privileges or user interaction to trigger this vulnerability.

No authentication required.
Triggered by specially crafted network request.
Allows full system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code remotely on systems running the affected software. This could occur when the software is accessed over a network, potentially impacting its integrity and availability.

Affected system code execution.
Unauthenticated network access.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the unauthenticated remote code execution in AjaxLoadMore Cache, application owners and platform teams are likely responsible for its management. The immediate priority is to identify all instances of the affected technology, confirm its exposure and business criticality, and assign an owner for remediation planning.

App owners and platform teams.
Confirm plugin reachability and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ajax Load More Cache plugin?

Ajax Load More Cache is a WordPress plugin designed to optimize website performance. It stores temporary copies of content loaded via Ajax requests, allowing a site to serve data faster to visitors. By reducing the load on the database, it helps websites handle high traffic volumes more efficiently, which is why it is often integrated into public-facing web pages.

What does CVE-2026-61991 mean by CWE-94?

CWE-94 refers to improper control of generation of code, often called Code Injection. In the context of CVE-2026-61991, this means the software incorrectly handles specific input, allowing that input to be executed as commands. An attacker can use this flaw to run their own unauthorized instructions directly on the server hosting the plugin.

How is this vulnerability triggered?

The vulnerability is triggered when an attacker sends a specially crafted network request to the server. Because the plugin fails to verify the requester's identity, no login or special user permissions are required to initiate the attack. However, simply visiting a page that uses the plugin does not trigger the bug; the attacker must deliberately send specific, malicious data to the server.

Is my site at risk from CVE-2026-61991?

If you use this plugin, your risk is elevated. According to Halo Surface Signal, this vulnerability affects a component designed to enhance public-facing web applications. Because these plugins are typically deployed to serve content over the internet, they are naturally exposed to network-based threats by default. You should check if your web infrastructure includes this specific plugin.

What should I do if I run this software?

Start by identifying all websites or staging environments where Ajax Load More Cache is currently installed. Once you have a list of affected instances, assess how critical these sites are to your business. Coordinate with your application owners to confirm the plugin's reachability and prepare for remediation, prioritizing public-facing systems that are accessible over the internet.

References

patchstack.com/database/wordpress/plugin/ajax-load-more-cache/vulner…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.