A widely used WordPress plugin has opened a dangerous hole: CVE-2026-11613 in “Divi Ajax Filter” lets unauthenticated attackers execute arbitrary PHP code on affected servers from afar. Researchers rate the flaw a critical 9.8 on the CVSS scale.
Why the flaw is so dangerous
The filter, built by vendor Divi Engine, processes the custom_loop_template parameter without adequate validation and passes it straight into a PHP include statement. This local file inclusion (CWE-98) can be triggered with a crafted AJAX request — no login, no user interaction. Attackers can include and run existing .php files on the server, and depending on the configuration that can escalate to full takeover of the site and the underlying host.
Affected versions and the patch
According to the advisory, every release up to and including 5.1.2 is vulnerable. Divi Engine fixed the issue in version 5.1.3, whose release notes reference CVE-2026-11613 explicitly. The flaw was publicly disclosed on 3 September 2026 and credited to a researcher going by “h0xilo”. Site operators should act without delay:
- Update the plugin to version 5.1.3 or later immediately.
- Review server and access logs for suspicious AJAX requests.
- Rotate credentials and secret keys if compromise is suspected.
Context
No in-the-wild exploitation has been documented so far. But because unauthenticated RCE bugs tend to draw automated attack waves quickly — as seen recently with several other WordPress plugins — fast patching is strongly advised. Anyone unable to apply the update at once should temporarily deactivate the plugin or restrict access via a firewall.
Sources: IONIX Threat Center · OffSeq Threat Radar · CVE Brief
