CVE-2026-91136
Divi Plus93/100
confirmed exploited
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or a
Listed in VulnCheck KEV (confirmed exploited in the wild) · EPSS 0.018 (probability of exploitation) · CVSS base 7.5 · 2 public PoC/exploit reference(s) available
Public PoC / Exploit2
Defensive review only — these references demonstrate exploitability.
References2