Executive Summary
CVE-2026-11613 is a critical Local File Inclusion (LFI) vulnerability in the Divi Ajax Filter plugin for WordPress, developed by Divi Engine. All versions up to and including 5.1.2 are affected via the custom_loop_template parameter, letting unauthenticated attackers include and execute arbitrary .php files on the server.
CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The flaw was reserved on 2026-06-08 and published on 2026-09-04, assigned by Wordfence and classified under CWE-98 (Improper Control of Filename for Include/Require Statement in a PHP Program).
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-11613 |
| CVSS Score | 9.8 (Critical) |
| CWE | CWE-98 — PHP Local/Remote File Inclusion |
| Type | Unauthenticated Local File Inclusion |
| Attack Vector | Network (no authentication required) |
| Privileges Required | None |
| User Interaction | None |
| Condition | loop_templates parameter must be set to custom-template |
Affected Versions
| Plugin | Affected Versions | Fixed Version |
|---|---|---|
| Divi Ajax Filter | ≤ 5.1.2 | Not yet published at time of writing |
Technical Details
Divi Ajax Filter's custom loop templates feature lets site builders point the plugin at a template file for faster, fully customized loop rendering. The custom_loop_template parameter that selects this file is not properly sanitized before being passed to a PHP include/require statement. When loop_templates is set to custom-template, an attacker can supply a path to an arbitrary file already present on the server — including uploaded images, log files, or any other attacker-influenced content — and have the plugin execute it as PHP.
Because no authentication is required and the vector is a standard AJAX request, this can be automated at scale against any site running a vulnerable version with the feature reachable.
Attack Vector
1. Attacker identifies a WordPress site running Divi Ajax Filter ≤ 5.1.2
2. Attacker (optionally) plants a file containing PHP code via any available
upload/write primitive (media library, log poisoning, etc.)
3. Attacker sends an AJAX request with loop_templates=custom-template and a
crafted custom_loop_template path pointing at that file
4. The plugin includes the file, executing any embedded PHP code
5. Attacker achieves code execution in the context of the web serverImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Remote Code Execution | Chainable with any file-write primitive to execute arbitrary PHP |
| Access Control Bypass | Read or include files outside the intended template directory |
| Sensitive Data Exposure | Include configuration files (e.g. wp-config.php) to leak credentials |
| Full Site Compromise | Combined with code execution, attacker gains full control of the WordPress install |
Immediate Remediation
- Check for a patch — monitor the WordPress.org plugin page and update to the fixed release as soon as it is available.
- Disable custom loop templates — until patched, avoid setting
loop_templatestocustom-template, or remove the feature's usage from affected templates. - Deploy a WAF rule blocking requests containing directory-traversal or unexpected file paths in the
custom_loop_templateparameter. - Audit uploads and writable directories for planted PHP payloads disguised as media or log files.
- Restrict file upload types so attacker-controlled content cannot contain executable PHP.
Detection Indicators
| Indicator | Description |
|---|---|
AJAX requests with loop_templates=custom-template and unusual custom_loop_template values | Possible exploitation attempt |
Unexpected .php files in uploads/media directories | Planted payload for LFI-to-RCE chaining |
| New or modified files with recent mtimes outside a deployment window | Sign of successful exploitation |
References
- NIST NVD — CVE-2026-11613
- OffSeq Threat Radar — CVE-2026-11613
- Divi Ajax Filter Documentation — Using Custom Loop Templates