Shinthink

**Name of the Vulnerable Software and Affected Versions** Divi Plus versions prior to 2.4.1 **Description** The Divi Plus plugin for WordPress allows unauthenticated attackers to read arbitrary files on the server. This occurs because the permission callback function `SVGAnimatorController::index permission()` returns true unconditionally, and the `svg image` parameter of the '/wp-json/elicus/v1/dipl-modules/svg-animator' REST endpoint is not properly validated. The input is processed by `sanitize text field()` and `esc html()`, which fail to restrict filesystem paths, arbitrary URLs, or the `file://` stream wrapper before being passed to `file get contents()` or `wp remote get()`. Consequently, the raw response body is returned in the JSON 'html' field, potentially leading to remote code execution. **Recommendations** Update the plugin to a version newer than 2.4.0. As a temporary workaround, restrict access to the '/wp-json/elicus/v1/dipl-modules/svg-animator' REST endpoint or avoid using the `svg image` parameter.