Local File Inclusion in Divi Ajax Filter Plugin for WordPress
CVE-2026-11613

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Divi Ajax Filter
Vendor
CVE Published:
4 September 2026

What is CVE-2026-11613?

The Divi Ajax Filter plugin for WordPress is susceptible to Local File Inclusion vulnerabilities across all versions up to 5.1.2. This flaw lies in the 'custom_loop_template' parameter, which allows unauthenticated attackers to include and execute arbitrary PHP files on the server. By manipulating this parameter, attackers can bypass access controls, extract sensitive information, or execute malicious PHP code, particularly when using the 'custom-template' setting for loop templates. It poses significant risks for sites utilizing this plugin, making it crucial for administrators to apply necessary updates and implement security measures.

Affected Version(s)

Divi Ajax Filter 0 <= 5.1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://diviengine.com/divi-ajax-filter-changelog/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

h0xilo
.