CVE-2026-11613

CVE-2026-11613 is a local file inclusion (CWE-98) in the Divi Ajax Filter plugin for WordPress, exploitable in all versions up to and including 5.1.2 through the 'custom_loop_template' parameter. The flaw can only be triggered when the plugin's 'loop_templates' parameter is set to 'custom-template'; in that configuration, an unauthenticated attacker can reach the vulnerable parameter over the network and cause the server to include an arbitrary .php file. Successful inclusion executes any PHP code contained in the chosen file, which an attacker can use to bypass access controls, read sensitive data, or gain full code execution if they can also upload a .php file that is then included. Any WordPress site running Divi Ajax Filter 5.1.2 or older with the custom-template loop setting enabled is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and the EPSS estimate puts 30-day exploitation probability at 0.5% (38th percentile).

What to do: Update Divi Ajax Filter to the latest release, which supersedes 5.1.2, as soon as a patched version is published. Sites that cannot update should disable or avoid the 'custom-template' loop_templates configuration, since the flaw is only exploitable in that mode, and consider WAF rules that block unauthenticated requests supplying the 'custom_loop_template' parameter. Administrators should also audit uploads for attacker-placed .php files and check logs for unexpected local file inclusion activity.