Security Alert Summary
The Divi Plus plugin for WordPress has a vulnerability that allows unauthenticated attackers to read arbitrary files on the site server via a REST API endpoint. The issue is caused by an unconditional permission callback and insufficient validation of an input parameter, which leads to file reads being returned in a JSON response.
CVE Details
- CVE ID: CVE-2026-91136
- Affected component: Divi Plus plugin (Divi Essential)
- Affected versions: Versions up to and including 2.4.0
- Published: October 10, 2026 at 9:16:39 AM
- Last modified: October 10, 2026 at 9:16:39 AM
- CVSS v3.1: Base score 7.5 – HIGH – Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Authentication / Privileges / User interaction: No authentication required; privileges required: NONE; user interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-22 (Path Traversal)
Technical Details
The vulnerability exists in the REST endpoint /wp-json/elicus/v1/dipl-modules/svg-animator via the svg_image parameter. The endpoint uses a permission callback named SVGAnimatorController::index_permission that returns true unconditionally. Combined with insufficient validation of the svg_image input – where sanitize_text_field() and esc_html() do not prevent filesystem paths, the file:// stream wrapper, or arbitrary URLs – the value is passed to file_get_contents() (with a wp_remote_get() fallback). The raw response body is then returned in the JSON html field.
Because the permission check allows unauthenticated access and the input is not restricted to safe resources, an attacker can cause the application to read arbitrary files from the server and return their contents in the API response. The advisory notes this arbitrary file read may make remote code execution possible, but the documented impact is an ability to read server files.
How This Could Impact Your Website
In a realistic scenario, an external attacker could use the vulnerable endpoint without authenticating. The site owner and internal staff – including editors or contractors who manage content or design – would not need to be targeted directly in order for the attacker to retrieve files from the server. Files commonly accessed by such attacks can include configuration files, backups, and other data that may contain database credentials, API keys, or user information.
Potential practical consequences include exposure of internal user email addresses and other sensitive data, which increases the risk of targeted phishing or social engineering against staff or contractors. The issue does not by itself guarantee full site takeover, but it raises the risk profile and could be chained with other issues. If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that have access to content or plugin settings.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual behavior, including unexpected API requests and file access patterns.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
