CVE-2026-2811 PUBLISHED

Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

Assigner: WPScan
Reserved: 19.02.2026 Published: 02.09.2026 Updated: 02.09.2026

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS Score: 5.4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Unknown
Product	Ajaxify Comments
Versions	Default: unaffected affected from 0 to 3.2 (excl.)

Credits

Azmi Alsarayrah finder
WPScan coordinator

References

https://wpscan.com/vulnerability/48250628-9b81-4bef-b623-356ceca01215/

Problem Types

CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') CWE