What CVE-2026-11613 Establishes
The disclosure identifies an unauthenticated local file inclusion flaw in Divi Ajax Filter through version 5.1.2. The vulnerable input is the `custom_loop_template` parameter, but the path is exploitable only when `loop_templates` is set to `custom-template`. Under that condition, an attacker can make the plugin include and execute an arbitrary PHP file on the server. Code inside that file then runs in the WordPress PHP process. The stated impact includes access-control bypass, sensitive-data exposure, and code execution where PHP files can be uploaded and included. The brief does not identify an endpoint, HTTP method, source filename, traversal syntax, or patch implementation, so those mechanics should not be assumed.
BitFire PRO RASP Protects the PHP Filesystem Boundary
BitFire PRO RASP enforces filesystem authorization when WordPress or PHP attempts to create or modify a PHP file. An unauthenticated request cannot use an upload handler or another writable path to plant a web shell, backdoor, plugin payload, or other executable PHP file for later inclusion. The same control blocks unauthorized changes to existing WordPress core and plugin PHP files. This protection is independent of a CVE-specific signature: enforcement happens at the protected write operation, after request processing begins but before the unauthorized PHP content is committed. That makes PHP-file protection a strong containment layer for the disclosed upload-and-include scenario.
The Protection Boundary Matters
RASP filesystem protection does not sanitize `custom_loop_template`, patch Divi Ajax Filter, or claim to stop every possible local file inclusion. Its role is precise: it blocks unauthorized creation or modification of PHP files. If an attacker tries to upload or write a PHP payload and then select it through the vulnerable parameter, BitFire PRO RASP stops the required file-write outcome. A PHP file that already exists on the server may present a different inclusion risk, and the disclosure also lists sensitive-data exposure and access-control bypass. Administrators must therefore treat RASP as an independent runtime safeguard, not as permission to leave version 5.1.2 exposed.
If Your Site Was Affected, Investigate for Persistence.
Update Divi Ajax Filter to version 5.1.3 or later immediately, then investigate every site that ran an affected release. Patching closes the disclosed vulnerable path but does not remove PHP payloads or persistence placed before the update. Run BitFire Threat Hunter to look for backdoor WordPress administrator accounts, hidden database triggers, WordPress or server cron persistence, long-running PHP processes, must-use plugins, startup-chain modifications, and droppers capable of restoring malware or reinfecting the site. Remove every discovered persistence mechanism, preserve and review relevant logs, and rotate relevant WordPress, hosting, database, and deployment credentials. The absence of an obvious malicious PHP file does not prove the installation is clean.
Patch Now and Enforce PHP-File Protection
CVE-2026-11613 exposes more than two million Divi Ajax Filter installations to a critical unauthenticated file-inclusion risk under the disclosed custom-template condition. Install version 5.1.3 or later without delay and enable BitFire PRO RASP to deny unauthorized PHP-file creation and modification at runtime. Where earlier exposure is possible, use Threat Hunter to find hidden persistence and complete a disciplined cleanup. BitFire gives administrators a firm filesystem control that prevents an upload or writable code path from becoming a durable PHP foothold while the vendor update removes the known inclusion flaw.
