Divi Ajax Filter
Monthly
Local File Inclusion in the Divi Ajax Filter WordPress plugin (all versions through 5.1.2) lets remote unauthenticated attackers include and execute arbitrary .php files on the server via the 'custom_loop_template' parameter. Reported by Wordfence and rated CVSS 9.8, it enables access-control bypass, sensitive-data disclosure, and - where an attacker can plant a .php file (e.g. through an upload) - remote code execution. No public exploit has been identified at time of analysis and the plugin is not in CISA KEV.
Local File Inclusion in the Divi Ajax Filter WordPress plugin (all versions through 5.1.2) lets remote unauthenticated attackers include and execute arbitrary .php files on the server via the 'custom_loop_template' parameter. Reported by Wordfence and rated CVSS 9.8, it enables access-control bypass, sensitive-data disclosure, and - where an attacker can plant a .php file (e.g. through an upload) - remote code execution. No public exploit has been identified at time of analysis and the plugin is not in CISA KEV.