CVE-2026-61991: WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability
Published Oct 29, 2026
·Updated
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
Event History
Oct 29, 2026
CVE Published
via MITRE·03:24 PM
Data Sourced
via MITRE·03:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to exploitation?
WordPress sites with the AjaxLoadMore Cache plugin at version 3.1.1 or earlier are affected.
2
Does an attacker need a WordPress account or user interaction?
No. The vulnerability is unauthenticated and can be exploited remotely without credentials or user interaction.