Divi Ajax Filter WordPress Plugin Vulnerable to Local File Inclusion
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- divi ajax filter plugin (wordpress)
- Patched version
- Not yet available
The Divi Ajax Filter plugin for WordPress is reportedly vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2. This vulnerability allows unauthenticated attackers to include and execute arbitrary.php files on the server.
What happened
An early warning has been issued regarding a critical vulnerability in the Divi Ajax Filter plugin for WordPress. The vulnerability, tracked as CVE-2026-11613, is a Local File Inclusion issue that affects all versions up to, and including, 5.1.2. This flaw is present in the 'custom_loop_template' parameter, which allows unauthenticated attackers to include and execute arbitrary.php files on the server. The vulnerability has a CVSS score of 9.8, indicating a critical severity level.
The vulnerability was first flagged on September 4, 2026. It is currently under investigation and has not been reported as exploited in the wild. Users of the Divi Ajax Filter plugin are advised to take immediate action to mitigate potential risks.
What to do about it
- Monitor the Divi Ajax Filter plugin for any updates or patches that address the Local File Inclusion vulnerability.
- If an updated version of the plugin is released, upgrade to a version beyond 5.1.2 immediately.
- Review and strengthen server access controls to limit the potential impact of this vulnerability.
- Consult the primary sources for the latest information on the vulnerability and any available fixes.
How 0Day would have caught this
divi ajax filter plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Divi Ajax Filter plugin for WordPress in versions up to, and including, 5.1.2, you are potentially affected by this vulnerability.
What should I do right now?
Monitor the Divi Ajax Filter plugin for any updates or patches. If an updated version is released, upgrade to a version beyond 5.1.2 immediately. Additionally, review and strengthen your server access controls.
Is there an official fix available yet?
No official fix has been published yet. Monitor the primary sources for updates on any available patches.