Local File Inclusion Vulnerability in Divi Ajax Filter

The Divi Ajax Filter plugin for WordPress contains a critical Local File Inclusion (LFI) vulnerability, tracked as CVE-2026-11613, affecting all versions up to and including 5.1.2. The vulnerability resides in the handling of the 'custom_loop_template' parameter. An unauthenticated attacker can exploit this flaw by setting the 'loop_templates' parameter to 'custom-template', which fails to adequately sanitize user input. If an attacker can successfully upload a malicious PHP file to the server or otherwise gain control over a local file, they can include and execute that file to achieve Remote Code Execution (RCE). This vulnerability poses a severe risk to WordPress installations as it allows for complete site compromise, data exfiltration, and unauthorized access to system resources. Defenders should prioritize updating the plugin immediately upon the release of a patch.

Impact

Successful exploitation of CVE-2026-11613 allows unauthenticated attackers to execute arbitrary PHP code on the target web server. This can lead to total server compromise, unauthorized access to sensitive database content, and the potential to move laterally within the hosting environment. The impact is critical, as it bypasses standard access controls to facilitate RCE.

Recommendation

• Upgrade the Divi Ajax Filter plugin to the latest available version beyond 5.1.2 immediately to remediate the vulnerable parameter handling.
• Implement strict file upload restrictions to prevent attackers from placing malicious PHP scripts that could be leveraged by this LFI vulnerability.
• Deploy Web Application Firewall (WAF) rules to inspect incoming requests for anomalous values in the 'custom_loop_template' and 'loop_templates' parameters.
• Audit existing WordPress plugins for unauthorized or outdated components that could be targeted via similar LFI vectors.