Divi Ajax Filter CVE-2026-11613

Requires the Divi Ajax Filter plugin (≤5.1.2) installed and active, and - per the description - the 'loop_templates' parameter must be set to 'custom-template', which gates the vulnerable code path; attacks then abuse the 'custom_loop_template' parameter on the AJAX endpoint. No authentication or user interaction is needed (PR:N/UI:N). Escalation from file disclosure to arbitrary PHP execution is further limited by the need for an attacker-includable .php file to exist on the server (e.g. via an upload primitive); inclusion of existing server files still yields data disclosure and access-control bypass without that precondition.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects an unauthenticated, network-reachable inclusion flaw, a high-priority pattern for WordPress plugins. However, the description states exploitation is only possible 'when the loop_templates parameter is set to custom-template', and full code execution additionally depends on an attacker-plantable .php file being present - both conditions temper the raw 9.8 and arguably justify higher attack complexity than the vendor's AC:L. No EPSS score, KEV listing, or POC was supplied, so real-world exploitation pressure is currently unquantified; the flaw should be treated as a serious LFI (assured confidentiality/info-disclosure impact) with conditional escalation to RCE rather than a turnkey RCE. Given Divi's large install base, opportunistic scanning for vulnerable Divi add-ons is plausible once details circulate.

With the plugin active and custom-template mode in use, an attacker sends an unauthenticated AJAX request setting 'custom_loop_template' to a chosen server-side .php path; the plugin includes and executes that file, disclosing its contents or side effects. If the attacker has previously uploaded a .php payload (for example via a permissive media or import feature), the same request executes that payload for remote code execution. No public POC was provided at time of analysis.