CVE-2026-91707 Elegant Themes CVE debrief

Who should care

Defenders responsible for WordPress installations using the Divi theme should assess exposure and prioritize verification and remediation. This includes reviewing current theme versions, restricting shortcode execution, and monitoring for suspicious activity. Security teams and operators managing WordPress environments with the Divi theme are particularly impacted and should take immediate action to verify and mitigate the vulnerability.

Why it matters

The Divi theme for WordPress is vulnerable to arbitrary shortcode execution, allowing unauthenticated attackers to execute unintended actions. Defenders should prioritize verification and remediation to prevent exploitation.

• Unauthenticated attackers can execute arbitrary shortcodes
• Shortcode execution can lead to unintended actions
• Verification of Divi theme versions and shortcode restrictions is necessary
• Monitoring for suspicious activity and shortcode usage is recommended

Technical summary

The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes, potentially leading to various impacts on WordPress installations using the Divi theme. The vulnerability is caused by inadequate validation of user input before executing shortcodes.

Defensive priority

Defenders should prioritize verifying and updating Divi theme versions, restricting shortcode execution, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and update Divi theme versions to the latest
• Restrict shortcode execution to authenticated users
• Monitor for suspicious activity and shortcode usage
• Implement additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation and impact is limited. Defenders should verify the vulnerability's existence, assess exposure, and prioritize remediation based on the available information. The lack of detailed exploitation or impact data necessitates a cautious approach to verification and remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.