Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
criticalThe Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PH...
- CVSS:
- 9.8 (Wordfence)
- Affected:
- up to 5.1.2
- Fixed in:
- 5.1.3
- Disclosed:
- Sep 3, 2026