CVE-2026-91136

Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter

Divi Essential Divi Plus

CVSS

7.5High

ExploitationScanner template publicA Nuclei template detects it. Not in the KEV catalogNuclei

Exploit odds (EPSS)1.78%Chance of exploitation activity in the next 30 days, higher than 78% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Published10 Oct 2026Updated 11 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Public exploit code and templates 1

Scanner templateDivi Plus <= 2.4.0 - Unauthenticated Arbitrary File ReadNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON 'html' field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server which may make remote code execution possible.

Text from CVE List

Affected versions 1

Divi Plusaffected: all versions through 2.4.0CVE List