Arbitrary Shortcode Execution Vulnerability in Divi Theme for WordPress
CVE-2026-91707

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Divi
Vendor
CVE Published:
18 September 2026

What is CVE-2026-91707?

The Divi theme for WordPress exhibits a vulnerability that allows arbitrary shortcode execution, affecting all versions up to 5.11.1. This security issue stems from inadequate validation processes when executing actions via the do_shortcode function. Notably, if the 'Force Enable D4 Shortcode Framework' setting is enabled, this vulnerability permits unauthenticated attackers to run harmful shortcodes, such as the et_pb_contact_form shortcode, which can be leveraged to send emails to any recipient chosen by the attacker, potentially containing malicious content.

Affected Version(s)

Divi 0 <= 5.11.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.divichangelog.com/
https://www.divichangelog.com/divi-update/divi-5/version-...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Osvaldo Noe Gonzalez Del Rio (Os)
.