CVE-2026-91136 Divi Essential CVE debrief

Who should care

WordPress site administrators and security teams using Divi Plus plugin version 2.4.0 or earlier should prioritize updating the plugin and monitoring their sites for potential exploitation. This vulnerability has a high CVSS score of 7.5, indicating a high severity level. Immediate attention is required to prevent potential remote code execution and unauthorized access to sensitive files.

Why it matters

CVE-2026-91136 allows unauthenticated attackers to read arbitrary files on affected WordPress sites using Divi Plus plugin version 2.4.0 or earlier. This vulnerability has a high CVSS score of 7.5 and requires immediate attention from WordPress site administrators and security teams.

• Potential for remote code execution
• Unauthenticated access to sensitive files
• Possible exploitation by attackers
• Verification of patch application required

Technical summary

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback returning true unconditionally combined with insufficient validation of the 'svg_image' input. The insufficient validation allows for arbitrary file reads, which could potentially lead to remote code execution on affected WordPress sites using Divi Plus plugin version 2.4.0 or earlier.

Defensive priority

High priority for WordPress site administrators and security teams

Recommended defensive actions

• Update Divi Plus plugin to a version beyond 2.4.0
• Restrict access to the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint
• Monitor for suspicious activity on WordPress sites using Divi Plus
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in Divi Plus plugin versions up to and including 2.4.0. The /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint's permission callback returns true unconditionally, and insufficient validation of the 'svg_image' input allows for arbitrary file reads. This issue was identified through CVE Program records and supplemental source references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.