Executive Summary

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 5.1.2. This vulnerability, tracked as CVE-2026-11613, allows unauthenticated attackers to include and execute arbitrary .php files on the server, potentially leading to code execution, bypassing access controls, and obtaining sensitive data.

Technical Analysis

The vulnerability is caused by inadequate input validation in the 'custom_loop_template' parameter. Specifically, when the 'loop_templates' parameter is set to 'custom-template', an attacker can manipulate this parameter to include arbitrary .php files on the server. This is a classic example of a Local File Inclusion (LFI) vulnerability, which falls under the CWE-98 category.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted request to the vulnerable endpoint with a manipulated 'custom_loop_template' parameter. For example, an attacker could send a request with a parameter value that includes a malicious PHP file located on the server, such as /wp-content/uploads/malicious.php. If the server is configured to execute PHP files in the uploads directory, the attacker could achieve arbitrary code execution as the web service user, potentially allowing them to pivot to internal databases or take control of the server.

Impact Assessment

The impact of this vulnerability is severe, with a CVSS score of 9.8 indicating critical severity. Any WordPress installation using the Divi Ajax Filter plugin up to version 5.1.2 is potentially vulnerable. Successful exploitation could lead to:

  • Arbitrary code execution
  • Bypassing access controls
  • Obtaining sensitive data

Recommended Actions

To mitigate this vulnerability:

  • Update the Divi Ajax Filter plugin to version 5.1.3 or later.
  • Implement a Web Application Firewall (WAF) rule to block requests with suspicious 'custom_loop_template' parameter values.
  • Monitor server logs for unusual file inclusion requests.

Sources

  • National Vulnerability Database (NVD)
  • Wordfence
  • Divi Engine