CVE-2026-2811: CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Ajaxify Comments

CVE-2026-2811 describes an HTTP header injection vulnerability in the Ajaxify Comments WordPress plugin prior to version 3.2. The issue arises from insufficient input sanitization and output escaping of user-supplied data, enabling unauthenticated attackers to inject arbitrary HTTP headers. This vulnerability is categorized under CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers), commonly known as HTTP Response Splitting. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting medium severity with network attack vector, low attack complexity, no privileges required, and requiring user interaction.

Successful exploitation allows unauthenticated attackers to inject arbitrary HTTP headers, which can lead to HTTP response splitting attacks. This may enable attackers to manipulate web responses, potentially causing security issues such as web cache poisoning or cross-site scripting via crafted responses. The confidentiality and integrity impacts are low, and availability is not affected.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates and apply any official fixes once available. Until then, consider implementing input validation and output escaping as a temporary mitigation if possible.