Description

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T05:17:13.013Z",
  "pubdate": "2026-09-04T05:17:13.013Z",
  "executiveSummary": "The Divi Ajax Filter plugin for WordPress, in all versions up to and including 5.1.2, is susceptible to a critical Local File Inclusion (LFI) vulnerability.\nThis flaw originates from improper input validation within the 'custom_loop_template' parameter, which allows an unauthenticated attacker to manipulate file inclusion paths on the server.\nBy successfully exploiting this vulnerability, an attacker can include and execute arbitrary local PHP files, leading to Remote Code Execution (RCE) on the underlying server infrastructure.\nThe attack is contingent upon the 'loop_templates' parameter being explicitly set to 'custom-template', which functions as the trigger for the vulnerable code execution path.\nThe impact of this vulnerability is severe, as it enables unauthorized access to sensitive configuration files, database credentials, and provides the capability for full system compromise.\nGiven that the exploit does not require authentication, the risk is categorized as critical for all exposed WordPress installations utilizing this plugin.",
  "technicalDetails": "The vulnerability resides within the request handling logic of the Divi Ajax Filter plugin, specifically involving the processing of user-supplied input via the 'custom_loop_template' parameter.\nThe root cause is a lack of sufficient sanitization or input validation when the plugin constructs file system paths using this parameter. When the 'loop_templates' parameter is set to 'custom-template', the plugin attempts to load a template file using the value provided in 'custom_loop_template'.\nAn attacker can exploit this by crafting a malicious HTTP request where the 'custom_loop_template' parameter is populated with a path traversal string (e.g., ../../../etc/passwd or a path to a malicious PHP file).\nThe attack flow follows a sequential process: 1. The attacker identifies the endpoint that processes Ajax requests for the Divi Ajax Filter plugin. 2. The attacker triggers the vulnerable logic by setting the 'loop_templates' parameter to 'custom-template'. 3. The attacker injects a malicious file path or a path to a sensitive system file into the 'custom_loop_template' parameter. 4. The server-side code performs a 'require' or 'include' operation on the attacker-supplied path.\nBecause the plugin does not enforce a whitelist of allowed files or properly sanitize the path input, the PHP interpreter includes and executes the file at the attacker's chosen location.\nIf an attacker has previously uploaded a PHP script to the server (e.g., via an unrelated file upload vulnerability or an insecure media library upload), they can supply the path to that script within the 'custom_loop_template' parameter, resulting in arbitrary code execution within the context of the web server user.\nFurthermore, the vulnerability allows for the disclosure of sensitive file contents by leveraging PHP's capability to include files that contain configuration data or credentials, effectively bypassing standard WordPress access controls.\nThis vulnerability is classified as an unauthenticated, remote LFI, posing a significant risk to the integrity and confidentiality of the entire WordPress instance and the underlying server environment."
}