CVE-2026-91707: Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force Enable D4 Shortcode Framework' option is enabled, this includes invoking the etpbcontactform shortcode to send email to an attacker-selected recipient with attacker-controlled content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For Divi, disable the 'Force Enable D4 Shortcode Framework' option to prevent unauthenticated arbitrary shortcode execution (including invocation of the et_pb_contact_form shortcode to send email with attacker-controlled content).
Event History
Frequently Asked Questions
Does an attacker need a WordPress account or user interaction to exploit this issue?
No. The issue is described as exploitable by unauthenticated attackers, with no user interaction required.
Which deployments have the most direct additional impact?
Deployments with the “Force Enable D4 Shortcode Framework” option enabled can have the et_pb_contact_form shortcode invoked to send email to an attacker-selected recipient using attacker-controlled content.
What versions should be considered affected?
All Divi theme versions up to and including 5.11.1 are identified as affected.