Divi Ajax Filter WordPress Plugin Local File Inclusion (LFI) Vulnerability

Technical Analysis

CVE-2026-11613 is a Local File Inclusion (LFI) vulnerability in the Divi Ajax Filter plugin, exploitable through the 'custom_loop_template' parameter when 'loop_templates' is set to 'custom-template'. Because the parameter fails to properly sanitize or restrict file paths, unauthenticated attackers can force the application to include and execute arbitrary .php files, resulting in remote code execution when combined with file upload primitives (e.g., log poisoning, media library uploads) or other means of planting PHP payloads on the server. This can be leveraged to bypass authentication, exfiltrate sensitive configuration data (including database credentials and API keys), or establish persistent backdoors within the WordPress environment. Given the 9.8 CVSS score and lack of authentication requirement, this is a highly exploitable, internet-facing vulnerability likely to be targeted by automated scanning and exploitation tools shortly after disclosure. For organizations running AI agents or RAG pipelines that integrate with WordPress-based content sources, admin panels, or plugins for content ingestion, a compromised host could expose stored API keys, database credentials, or agent orchestration secrets, enabling lateral movement into connected AI infrastructure.

Affected Systems

WordPress installations running the Divi Ajax Filter plugin, versions up to and including 5.1.2

Indicators of Compromise

• No specific IOCs published at this time; monitor for anomalous requests containing 'custom_loop_template' and 'loop_templates=custom-template' parameters in WordPress access logs

Remediation Steps

1. 1

   Update the Plugin

   Upgrade Divi Ajax Filter to a patched version beyond 5.1.2 as soon as it is released by the vendor.

2. 2

   Disable or Remove Plugin

   If no patch is available, temporarily disable or uninstall the Divi Ajax Filter plugin until a fix is released.

3. 3

   Web Application Firewall (WAF) Rules

   Deploy WAF rules to detect and block requests containing suspicious 'custom_loop_template' or 'loop_templates=custom-template' parameter values indicative of LFI attempts.

4. 4

   Restrict File Upload Capabilities

   Limit or disable PHP file uploads and execution in upload directories to reduce the risk of LFI-to-RCE escalation.

5. 5

   Audit Logs and Credentials

   Review server and application logs for signs of exploitation, and rotate any credentials or API keys that may have been stored on or accessible from the affected WordPress instance, including those used by connected AI agent or automation systems.