External risk intelligence

Divi Ajax Filter Local File Inclusion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-11613

The vulnerability affects a WordPress plugin, which is typically deployed as a public-facing web application. Since the plugin is intended to be accessible to visitors of the website, the vulnerable parameter is reachable from the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Divi Ajax Filter plugin for WordPress could allow attackers to execute arbitrary code on your servers by including and running PHP files. This is possible if the plugin is configured to use custom templates and attackers can exploit this to bypass security controls or access sensitive data.

Unauthenticated attackers can run malicious code.
Confirms need for relevant plugin review.
Assess exposure and confirm plugin relevance.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to a WordPress site using the Divi Ajax Filter plugin. If the `loop_templates` parameter is set to `custom-template`, the attacker can manipulate the `custom_loop_template` parameter to include and execute arbitrary PHP files on the server, potentially leading to unauthorized access or code execution.

No authentication required.
Triggered via `custom_loop_template` parameter.
Leads to arbitrary PHP file execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to include and execute arbitrary PHP files on the server when the `loop_templates` parameter is set to 'custom-template'. This could lead to the execution of any PHP code within those files, potentially bypassing access controls or obtaining sensitive data.

Server files could be compromised.
Arbitrary PHP code execution may occur.
Sensitive data exposure is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Divi Ajax Filter plugin likely requires coordinated action between the website owner or application administrators responsible for WordPress content and functionality, and the infrastructure or platform team managing the web server. The first practical step is to determine if the affected plugin is deployed on any critical or publicly accessible WordPress sites, identify the specific owner of those sites, and then plan remediation based on the potential exposure and business impact.

Identify website owners and application administrators.
Verify plugin presence and custom template use.
Plan remediation considering site criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Divi Ajax Filter plugin?

Divi Ajax Filter is a WordPress plugin designed to enhance search and filtering capabilities on websites built with the Divi theme. It allows site administrators to create dynamic, AJAX-based search experiences for visitors, often utilizing specific templates to display results. Because it is integrated directly into WordPress, it functions as a component of the web application's frontend infrastructure.

What does Local File Inclusion mean for CVE-2026-11613?

This vulnerability is classified as CWE-98: Improper Neutralization of Input During Web Page Generation ('PHP Remote File Inclusion'). In simple terms, it means the plugin fails to properly check input before using it to load files. Because of this flaw, an attacker can trick the server into loading and running unauthorized files, allowing them to execute malicious PHP code on your website.

How can an attacker trigger this vulnerability?

An attacker can exploit this by sending a crafted request to a site using the plugin. Crucially, the bug only triggers if the 'loop_templates' parameter is explicitly set to 'custom-template'. If this specific configuration is not in use, the vulnerable code path for 'custom_loop_template' cannot be reached, and the attack will not succeed.

Is my website at risk from this vulnerability?

If you run an internet-facing WordPress site using this plugin, you should consider the risk high. According to Halo Surface Signal, this vulnerability is considered external because the plugin is designed to be reachable by public visitors. Any site accessible via the internet that has the vulnerable parameter configuration enabled provides a potential entry point for unauthenticated attackers.

Do I need to take action to protect my server?

Yes. Start by identifying all WordPress instances where Divi Ajax Filter is installed. Verify if the 'loop_templates' setting is configured to 'custom-template' on any of these sites. Once you locate affected installations, coordinate with your web administrators to restrict access or apply updates as provided by the plugin developer to mitigate the risk of arbitrary code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.