CVE-2026-91136

Name of the Vulnerable Software and Affected Versions Divi Plus versions prior to 2.4.1

Description The Divi Plus plugin for WordPress allows unauthenticated attackers to read arbitrary files on the server. This occurs because the permission callback function SVGAnimatorController::index permission() returns true unconditionally, and the svg image parameter of the '/wp-json/elicus/v1/dipl-modules/svg-animator' REST endpoint is not properly validated. The input is processed by sanitize text field() and esc html(), which fail to restrict filesystem paths, arbitrary URLs, or the file:// stream wrapper before being passed to file get contents() or wp remote get(). Consequently, the raw response body is returned in the JSON 'html' field, potentially leading to remote code execution.

Recommendations Update the plugin to a version newer than 2.4.0. As a temporary workaround, restrict access to the '/wp-json/elicus/v1/dipl-modules/svg-animator' REST endpoint or avoid using the svg image parameter.