CVE-2026-91136: Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::indexpermission) returning true unconditionally combined with insufficient validation of the 'svgimage' input — sanitizetextfield() and eschtml() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to filegetcontents() (with a wpremoteget() fallback) and the raw response body is returned in the JSON 'html' field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
Do attackers need a WordPress account or any special privileges?
No. The endpoint's permission callback returns true unconditionally, so an unauthenticated remote attacker can reach it without WordPress credentials.
What inputs can be used to retrieve data?
The svg_image parameter is not restricted to safe filesystem paths. It can accept filesystem paths, file:// stream-wrapper paths, and arbitrary URLs before the value is passed to file_get_contents(), with a wp_remote_get() fallback.
How can I determine whether an installation is affected?
Check whether Elicus Divi Plus is installed and whether its version is 2.4.0 or earlier. The affected REST endpoint is /wp-json/elicus/v1/dipl-modules/svg-animator, and retrieved content is returned in the JSON html field.
What is the likely impact if exploitation succeeds?
An attacker can read arbitrary files from the affected server, potentially exposing sensitive configuration or credential material. The available information notes that this file-read capability may make remote code execution possible.