Executive brief
The Ajaxify Comments WordPress plugin allows website visitors to comment on posts via an AJAX interface. An unauthenticated attacker can inject arbitrary HTTP headers by manipulating user-supplied input, potentially enabling cache poisoning, session hijacking, or other header-based attacks that could compromise website functionality or visitor data.
Technical details
The vulnerability is an HTTP Header Injection flaw in the Ajaxify Comments plugin before version 3.2, caused by insufficient input sanitization and output escaping of user-supplied data. Attackers can inject arbitrary HTTP headers (e.g., via the WPACUnapproved parameter) without requiring authentication. The attack is triggered via a crafted HTTP request, and successful exploitation allows injection of custom headers that may be reflected in server responses. A patch is available in version 3.2 and later.
Affected products
- Azmi Alsarayrah Ajaxify Comments before 3.2
Timeline
- 2026-02-27: disclosed
- 2026-02-27: patched: Fixed in version 3.2