Missing authorization in Elegant Themes Divi
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force Enable D4 Shortcode Framework' option is enabled, this includes invoking the et_pb_contact_form shortcode to send email to an attacker-selected recipient with attacker-controlled content.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Elegant Themes | Divi | up to 5.11.1 | — | No fix listed | CNA |
- Divi VendorElegant Themes Affected up to 5.11.1 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:elegantthemes:divi:*:*:*:*:*:*:*:* | — | — | Elegant Themes |
- cpe:2.3:a:elegantthemes:divi:*:*:*:*:*:*:*:* Versions — — ·Elegant Themes
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-91707
- 2026-10-03 Alias added: GHSA-8xr3-mxv3-qm4h
References
More Elegant Themes vulnerabilities
- TI-2020-18386 An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme… CVSS 3.1CRITICAL 9.9
- TI-2016-09042 The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation. CVSS 3.1HIGH 8.8
- TI-2016-09041 The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation. CVSS 3.1HIGH 8.8
- TI-2016-09040 The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation. CVSS 3.1HIGH 8.8
- TI-2015-01413 Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows… CVSS 2.0MEDIUM 5.0
- TI-2024-05243 Cross-site scripting in BlossomThemes Social Feed CVSS 3.1MEDIUM 6.4
Sources
- CVE-2026-91707 · CVE Program
- CVE-2026-91707 · NVD
- FIRST EPSS
- GHSA-8xr3-mxv3-qm4h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences