Ajax Load More Cache: Unauthenticated remote code execution
Summary
The Cache add-on for the WordPress plugin Ajax Load More, in versions 3.1.1 and earlier, contains an unauthenticated remote code execution flaw (CWE-94, code injection). An attacker on the internet can send crafted requests without a login and, according to the Patchstack classification, run arbitrary commands on the server. Exposure depends on whether the add-on is installed on an internet-facing WordPress site.
Affected
- Ajax Load More Cache add-on, versions <= 3.1.1
- Exact exploit conditions: Unknown.
Fixed in
- Unknown. No vendor fix or patched version confirmed at the time of writing.
Workaround
- Deactivate or remove the Cache add-on on sites where it is not business-critical.
- Review the cache directory (/wp-content/uploads/alm-cache/ by default) for unexpected files.
- Patchstack reports a mitigation rule that blocks attacks until an official patch is available; verify whether it is applicable.
Exploitation
- Exploited in the wild: No evidence found; CISA KEV: No.
- Public proof of concept: None found for this CVE.
- Patchstack rates it high priority and expects exploitation.
Our recommendation
- Inventory all client WordPress sites for the Cache add-on and its version.
- Remove or deactivate the add-on where it is not needed; treat internet-facing affected sites as high priority.
- Apply Patchstack mitigation or other WAF rules where possible.
- Monitor Patchstack, NVD and the Connekthq changelog for a fixed version, then update and re-verify.
- If a vulnerable site may have been exposed, check it for signs of compromise and for unexpected PHP files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Strix CVE record www.strix.ai
- ThreatInt CVE record cve.threatint.com
- Connekthq Ajax Load More Cache add-on connekthq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:52.
Original description (NVD)
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.