Read the docs
TI-2026-70167 Aliases CVE-2026-91136GHSA-9676-xmxf-xp84

Divi Plus Unauthenticated Arbitrary File Read via svg_image Parameter

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

The Divi Plus plugin for WordPress, in versions up to and including 2.4.0, contains a path traversal flaw in the 'svg_image' parameter of its svg-animator REST endpoint. The endpoint's permission check always returns true, and the input is not restricted to safe paths before it is read with file_get_contents(), so an unauthenticated remote attacker can read arbitrary files on the server. The sources note that this may make remote code execution possible.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON 'html' field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server which may make remote code execution possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02859 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Divi EssentialDivi Plusup to 2.4.0—No fix listedCNA
  • Divi Plus VendorDivi Essential Affected up to 2.4.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Divi Plus.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-91136
  2. 2026-10-10 Alias added: GHSA-9676-xmxf-xp84
  3. 2026-10-11 Priority changed: MEDIUM → LOW
  4. 2026-10-11 CISA SSVC decision points changed
  5. 2026-10-11 Priority changed: LOW → MEDIUM
  6. 2026-10-13 EPSS moved to the 50th–90th percentile

References

Other 2

  • TI-2026-13259 Missing authorization in Divi Essentials CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences