A critical (CVSS 9.8) local file inclusion flaw in the Divi Ajax Filter WordPress plugin lets unauthenticated attackers include and execute arbitrary .php files on the server.
What Is It
CVE-2026-11613 is a Local File Inclusion vulnerability (CWE-98, improper control of filename for include/require in a PHP program) in the Divi Ajax Filter plugin for WordPress, published on 2026-09-04 and reported by Wordfence. The flaw sits in the handling of the custom_loop_template parameter, which is not properly constrained before being used to include a file. Exploitation requires the loop_templates parameter to be set to custom-template; under that condition, an attacker can point the include at arbitrary .php files on the server and have their contents executed.
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability. Because any PHP code in an included file runs, the bug can be used to bypass access controls, obtain sensitive data, or reach full remote code execution where an attacker can get a .php file uploaded to a location they can then include. The supplied record contains no CISA KEV entry for this CVE, which means no confirmed exploitation or federal remediation deadline has been recorded in the source material; not that exploitation is absent in the wild.
What's Vulnerable
- Vendor: Divi Engine
- Product: Divi Ajax Filter (WordPress plugin)
- Affected versions: all versions up to and including 5.1.2
- Not affected: default status for versions outside that range is unaffected
The supplied record includes no CPE match data, so the affected-version boundaries above have not been corroborated against structured platform enumeration.
Patch Status
NVD lists the CVE with a vulnStatus of "Deferred" (last modified 2026-09-04). The supplied data does not name a fixed version, though a patched release may exist outside the source material reviewed here. The vendor changelog for Divi Ajax Filter is referenced by the CVE and is the authoritative place to confirm the patched release; administrators running 5.1.2 or earlier should treat the installation as vulnerable and update to a release published after this advisory. The source material carries no required-action or due-date guidance, consistent with the absence of a KEV entry in the supplied record.
Sources
- NVD, CVE-2026-11613: https://nvd.nist.gov/vuln/detail/CVE-2026-11613
- Divi Engine; Divi Ajax Filter changelog: https://diviengine.com/divi-ajax-filter-changelog/
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/8fbb92ac-a8e7-480d-8910-416fbe902a2a?source=cve