GHSA-57X3-7P7V-J5J4严重未审查

无摘要

OSV 1.4.0 · unreviewed · 修改于 2026-09-04 14:31

发布时间

2026-09-04 14:31

GitHub 审查时间

—

NVD 发布时间

2026-09-04 13:17

源文件

advisories/unreviewed/2026/09/GHSA-57x3-7p7v-j5j4/GHSA-57x3-7p7v-j5j4.json

公告说明

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.

受影响的软件包

该公告没有提供结构化的受影响软件包信息。

参考链接

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-11613

标识信息

别名 / CVE

CVE-2026-11613

CWE

CWE-98

软件生态

无

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-57x3-7p7v-j5j4",
  "aliases": [
    "CVE-2026-11613"
  ],
  "details": "The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.",
  "affected": [],
  "modified": "2026-09-04T06:31:22Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "published": "2026-09-04T06:31:22Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11613",
      "type": "ADVISORY"
    },
    {
      "url": "https://diviengine.com/divi-ajax-filter-changelog",
      "type": "WEB"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8fbb92ac-a8e7-480d-8910-416fbe902a2a?source=cve",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-98"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
    "nvd_published_at": "2026-09-04T05:17:13Z",
    "github_reviewed_at": null
  }
}