CVE-2026-91136
Received Received - Intake

Arbitrary File Read in Divi Plus WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Wordfence

Description
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON 'html' field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server which may make remote code execution possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-91136
EUVD
EUVD-2026-96298

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Divi Essential Divi Plus 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Divi Plus WordPress plugin has an Arbitrary File Read vulnerability in versions up to 2.4.0. An unauthenticated REST endpoint allows attackers to read arbitrary files on the server by exploiting improper input validation in the 'svg_image' parameter. The endpoint uses insufficient sanitization functions before passing the input to file_get_contents(), enabling file access that could lead to remote code execution.

Detection Guidance

Check if the Divi Plus plugin version is up to date. Inspect server logs for requests to the /wp-json/elicus/v1/dipl-modules/svg-animator endpoint with the svg_image parameter. Look for unusual file reads or unauthorized access attempts.

Impact Analysis

This vulnerability allows attackers to read sensitive files on your server without authentication. They could access configuration files, database credentials, or other confidential data. In some cases, this could lead to remote code execution if combined with other vulnerabilities, potentially compromising your entire WordPress installation and hosting environment.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data stored on the server, violating GDPR's data protection requirements. For HIPAA-covered entities, it may result in unauthorized access to protected health information, potentially causing compliance breaches. Organizations must address this vulnerability promptly to maintain regulatory compliance.

Mitigation Strategies

Update the Divi Plus plugin to version 2.4.1 or later immediately. Disable the svg-animator module if not needed. Implement additional file access restrictions on the server and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91136. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart