Threat Overview
A critical security flaw in Divi Ajax Filter, a popular enhancement plugin for Divi-powered websites, allows unauthenticated remote attackers to execute Local File Inclusion (LFI). By supplying manipulated file path parameters in filter loop requests, attackers can force the web server to execute arbitrary local PHP files, leading to sensitive configuration exposure and potential remote code execution.
| Threat Metric | Technical Details |
|---|---|
| Severity Rating | CRITICAL (CVSS 9.8 / 10.0) |
| Vulnerability Class | Improper Control of Filename for Include/Require (CWE-98) / Local File Inclusion |
| Vulnerable Component | Divi Ajax Filter Plugin (versions up to and including 5.1.2) |
| Attack Vector | Manipulated custom_loop_template parameters sent to dynamic AJAX filtering actions |
The Breakdown: How the Exploit Works
Divi Ajax Filter provides dynamic filtering, search grids, and custom taxonomy sorting for Divi layouts. When rendering filtered post results, the plugin allows developers to specify custom template layouts to display content cards dynamically.
The vulnerability stems from the plugin accepting user-controlled path arguments via the custom_loop_template parameter without adequate directory traversal sanitization or path whitelisting. When the template mode is set to custom rendering, an unauthenticated attacker can submit relative file path trajectories. The underlying PHP runtime passes this string directly to an internal include or require statement, executing any local .php file on the filesystem with the web server’s runtime privileges.
The Operational Risk: What an Attacker Gains
Local File Inclusion in dynamic server environments creates severe compound risks:
- Credential & Secret Exposure: Threat actors can target server configuration scripts containing database passwords, encryption salts, and cloud service tokens.
- Remote Code Execution via Log Poisoning: If combined with web server access logs or image upload directories containing embedded PHP snippets, attackers escalate the inclusion flaw into full server execution.
Our Take in Plain English
“Dynamic template inclusion is an architectural relic of 2000s-era server programming. When an application asks the server to dynamically fetch and run a piece of code based on a web visitor’s filter request, a missing validation check turns the whole server filesystem into an open book. In modern pre-rendered edge architecture, filtering and sorting occur instantly on the client device or through structured data queries. There are no server-side include statements, making file inclusion attacks architecturally impossible.”
The Modern Architectural Remedy
- Legacy Dynamic WordPress: Resolves visual templates at runtime through PHP file execution on the production host, creating acute vulnerabilities whenever input paths are insufficiently constrained.
- Modern Pre-Rendered Architecture: Pre-renders all catalog structures and delivers filtering via client-side data indexes or static edge queries with zero runtime file execution.
Immediate Action Items for WordPress Operators
- Update Divi Ajax Filter: Update the Divi Ajax Filter plugin to version 5.1.3 or higher immediately.
- Review Custom Template Configurations: Ensure custom loop options are locked to hardcoded paths and cannot be overridden by query parameters.
- Audit Access Logs: Monitor server access logs for requests containing directory traversal sequences (such as
../) targeting filter AJAX endpoints.