Description
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.
Published: 2026-09-04
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Divi Ajax Filter plugin for WordPress is vulnerable to unauthenticated Local File Inclusion via the \"custom_loop_template\" parameter. This weakness, mapped to CWE‑98, allows an attacker to force the server to include and execute arbitrary .php files, giving the ability to run arbitrary PHP code, bypass access controls, and exfiltrate or modify sensitive data.

Affected Systems

All installations of Divi Ajax Filter with versions up to and including 5.1.2 are affected. An attacker can exploit the flaw only when the plugin’s loop_templates option is set to \"custom-template\", enabling the vulnerable custom_loop_template parameter.

Risk and Exploitability

The vulnerability receives a CVSS score of 9.8, indicating a critical level of risk. The EPSS score is not available, but the fact that this flaw can be exploited without authentication and leads to code execution places it at a very high threat level. The vulnerability is not currently listed in the CISA KEV catalog, yet its high severity and potential for local file inclusion make it a priority for remediation.

Generated by OpenCVE AI on September 4, 2026 at 06:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Divi Ajax Filter plugin to a version that removes the vulnerable custom_loop_template functionality.
  • If an immediate update is not possible, disable the custom_loop_template feature by setting the loop_templates setting to a safe value or removing the custom-template option from the plugin settings.
  • Ensure that server file permissions prevent execution of arbitrary .php files outside the intended directories or implement a web application firewall rule to block inclusion requests for arbitrary file paths.

Generated by OpenCVE AI on September 4, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Divi Engine
Divi Engine divi Ajax Filter
Wordpress
Wordpress wordpress
Vendors & Products Divi Engine
Divi Engine divi Ajax Filter
Wordpress
Wordpress wordpress

Fri, 04 Sep 2026 04:45:00 +0000

Type Values Removed Values Added
Description The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.
Title Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Divi Engine Divi Ajax Filter
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-04T04:29:08.298Z

Reserved: 2026-06-08T17:50:49.001Z

Link: CVE-2026-11613

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-04T05:17:13.013

Modified: 2026-09-04T13:22:24.073

Link: CVE-2026-11613

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T15:20:34Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')