Arbitrary File Read Vulnerability in Divi Plus Plugin for WordPress

CVE-2026-91136

What is CVE-2026-91136?

The Divi Plus plugin for WordPress contains a vulnerability that allows unauthenticated attackers to read arbitrary files on the server. This vulnerability originates from an insufficiently secured REST endpoint, which does not validate the 'svg_image' parameter properly. Consequently, under certain conditions, attackers can exploit this weakness to gain unauthorized access to sensitive files, potentially leading to remote code execution. The lack of appropriate permission checks within the SVGAnimatorController::index_permission method further compounds the risk, making it crucial for users to apply the recommended updates to secure their sites.

References