A critical vulnerability in the Divi Ajax Filter plugin allows unauthenticated attackers to execute arbitrary PHP code on affected WordPress sites, posing a severe risk of full system compromise.

This is a Local File Inclusion vulnerability (CWE-98) triggered via the custom_loop_template parameter. The flaw allows unauthenticated attackers to include and execute arbitrary PHP files on the server when the loop_templates parameter is set to custom-template.

The ability for an unauthenticated attacker to execute arbitrary code grants them complete control over the WordPress installation and potentially the underlying server environment. Given the CVSS score of 9.8, this vulnerability represents an extreme risk, as it facilitates data exfiltration, unauthorized administrative access, and potential lateral movement within the network.

Immediate Action: Administrators should immediately update the Divi Ajax Filter plugin to the latest available version provided by Divi Engine. If an update is not currently available, the plugin should be deactivated until a patch is applied.

Proactive Monitoring: Review web server access logs for suspicious requests containing the custom_loop_template or loop_templates parameters, particularly those attempting to reference local file paths or unexpected extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block incoming requests targeting the vulnerable parameters, which can effectively neutralize exploit attempts while awaiting a formal patch.

Public Exploit Available: No confirmed public exploit (none).

Due to the critical nature of this flaw and the ease of exploitation, immediate action is required. All organizations using the Divi Ajax Filter plugin must verify their current version and apply updates as soon as they are released by the vendor to prevent potential compromise.