EUVD-2026-70888
GHSA-57x3-7p7v-j5j4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress AJAX endpoint unauthenticated
-
DeliverySet loop_templates to custom-template
-
ExploitSupply malicious custom_loop_template path
-
ExecutionPlugin includes/executes target .php
-
ImpactDisclose data or run PHP code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Divi Ajax Filter plugin (≤5.1.2) installed and active, and - per the description - the 'loop_templates' parameter must be set to 'custom-template', which gates the vulnerable code path; attacks then abuse the 'custom_loop_template' parameter on the AJAX endpoint. No authentication or user interaction is needed (PR:N/UI:N). Escalation from file disclosure to arbitrary PHP execution is further limited by the need for an attacker-includable .php file to exist on the server (e.g. via an upload primitive); inclusion of existing server files still yields data disclosure and access-control bypass without that precondition. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects an unauthenticated, network-reachable inclusion flaw, a high-priority pattern for WordPress plugins. However, the description states exploitation is only possible 'when the loop_templates parameter is set to custom-template', and full code execution additionally depends on an attacker-plantable .php file being present - both conditions temper the raw 9.8 and arguably justify higher attack complexity than the vendor's AC:L. No EPSS score, KEV listing, or POC was supplied, so real-world exploitation pressure is currently unquantified; the flaw should be treated as a serious LFI (assured confidentiality/info-disclosure impact) with conditional escalation to RCE rather than a turnkey RCE. Given Divi's large install base, opportunistic scanning for vulnerable Divi add-ons is plausible once details circulate. |
| Exploit ScenarioDerived | With the plugin active and custom-template mode in use, an attacker sends an unauthenticated AJAX request setting 'custom_loop_template' to a chosen server-side .php path; the plugin includes and executes that file, disclosing its contents or side effects. If the attacker has previously uploaded a .php payload (for example via a permissive media or import feature), the same request executes that payload for remote code execution. No public POC was provided at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Local File Inclusion in the Divi Ajax Filter WordPress plugin (all versions through 5.1.2) lets remote unauthenticated attackers include and execute arbitrary .php files on the server via the 'custom_loop_template' parameter. Reported by Wordfence and rated CVSS 9.8, it enables access-control bypass, sensitive-data disclosure, and - where an attacker can plant a .php file (e.g. through an upload) - remote code execution. No public exploit has been identified at time of analysis and the plugin is not in CISA KEV.
RemediationAI
Upgrade Divi Ajax Filter to the first release above 5.1.2 listed in the Divi Engine changelog (https://diviengine.com/divi-ajax-filter-changelog/); the changelog reference indicates a fix but the exact patched build was not independently confirmed from the provided data, so verify the current version there before deploying. Until patched, deactivate the Divi Ajax Filter plugin, or if that is not feasible avoid/disable the 'custom-template' loop mode so the vulnerable path is unreachable, and add a WAF rule to block requests whose 'custom_loop_template' parameter references file paths (traversal sequences, absolute paths, or .php filenames). As hardening, ensure no user-writable directory permits .php upload/execution, since that is the pivot from LFI to code execution. Trade-offs: disabling the plugin or custom-template mode removes AJAX filtering on affected pages, and broad WAF filtering of the parameter may break legitimate template loading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Divi Ajax Filter plugin (CPE cpe:2.3:a:divi_engine:divi_ajax_filter), an add-on for the widely used Divi WordPress theme/page builder that provides AJAX-driven post filtering and template loading. The root cause is CWE-98 (Improper Control of Filename for Include/Require, the PHP file-inclusion class): a user-controlled value in the 'custom_loop_template' parameter is passed into a PHP include/require path without adequate sanitization or an allowlist, so the requested filename is resolved and executed by the PHP interpreter. Because the include occurs on an AJAX endpoint reachable without authentication, any attacker who can reach the site can influence which server-side .php file is loaded and run.
Know when Divi Ajax Filter gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network LFI, but exploitation is gated on custom-template mode and RCE needs an includable .php file, so AC:H rather than AC:L.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.
Articles & Coverage 1
Technical POC Analysis
The supplied advisory identifies CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) in the Divi Ajax Filter plugin for WordPress, affecting all versions up to and incl…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The Divi Ajax Filter WordPress plugin (versions through 5.1.2) contains a critical vulnerability allowing unauthenticated attackers to execute arbitrary code on any website running this plugin, creating immediate risk of data breach and website takeover. Given Divi's prevalence in the WordPress ecosystem, this affects a broad organizational and customer-facing exposure. No vendor patch is currently available, requiring immediate operational response.
Immediately disable and remove the Divi Ajax Filter plugin. If business requirements prevent removal, deploy Web Application Firewall rules blocking requests with the 'custom_loop_template' parameter; restrict file upload capabilities to administrative users only; disable PHP execution in upload directories through web server configuration (.htaccess or nginx config); maintain daily backups for rapid recovery; implement file integrity monitoring on web-accessible directories; monitor for unauthorized .php file creation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB