Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read
CVE-2026-91136
Early Release
Description
The Divi Plus WordPress plugin through 2.4.0 exposes the /wp-json/elicus/v1/dipl-modules/svg-animator REST route with a permission callback that returns true unconditionally, and passes the svg_image parameter to file_get_contents() without any path restriction, so an unauthenticated attacker can read any file readable by the web server user.
Severity
High
CVSS Score
7.5
Exploit Probability
1%
Affected Product
divi_plus
Published Date
October 12, 2026
Template Author
haroonarshad-53
CVE-2026-91136.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-91136
CWE ID:
cwe-22
Remediation Steps
Update Divi Plus to version 2.4.1 or later.