CVE-2026-2811
Received Received - Intake

HTTP Header Injection in Ajaxify Comments WordPress Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-2811
EUVD
EUVD-2026-70050

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ajaxify_comments ajaxify_comments to 3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Ajaxify Comments WordPress plugin before version 3.2 has a vulnerability that allows unauthenticated attackers to inject arbitrary HTTP headers. This happens because the plugin does not properly sanitize user-supplied input or escape output, enabling HTTP Header Injection attacks.

Detection Guidance

To detect this vulnerability, you can use the curl command to check if the Ajaxify Comments plugin is vulnerable. Run: curl -I "http://example.com/?WPACUnapproved=test". If the response includes a header like X-WPAC-Unauthorized: test, the site is likely vulnerable.

Impact Analysis

An attacker could exploit this to inject malicious HTTP headers, potentially leading to security bypasses, cache poisoning, or other attacks. It may also allow manipulation of responses or unauthorized actions on the affected website.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, which may violate GDPR's integrity and confidentiality requirements or HIPAA's security rules. Non-compliance risks include fines and legal consequences.

Mitigation Strategies

Immediately update the Ajaxify Comments plugin to version 3.2 or later to patch the vulnerability. If updating is not possible, consider disabling the plugin until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2811. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart