CVE-2026-2811: Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
WordPress sites using Ajaxify Comments versions earlier than 3.2 are affected. The issue is in the plugin, not WordPress generally.
Does exploitation require an account or special privileges?
No. The vulnerability is described as exploitable by unauthenticated attackers, so no WordPress account or prior privileges are required. Exploitation does require user interaction according to the supplied CVSS vector.
What is the impact of successful exploitation?
An attacker can inject arbitrary HTTP headers because user-supplied data is not sufficiently sanitized and escaped. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.