Divi Plus up to 2.4.0 – Unauthenticated Arbitrary File Read (CVE-2026-91136)

CVE-2026-91136 is a high-severity unauthenticated arbitrary file-read vulnerability in Divi Plus. Versions through 2.4.0 expose a REST endpoint that can retrieve attacker-selected filesystem paths and return their contents, potentially disclosing WordPress secrets and enabling follow-on compromise.

Affected versions and severity

• Plugin: Divi Plus by Divi Essential
• Affected: 2.4.0 and earlier
• Fixed: 2.4.1
• CVE: CVE-2026-91136
• Severity: High, CVSS 7.5
• Privileges required: None
• User interaction: None
• Attack class: Path traversal / arbitrary file read

How the vulnerability works

The vulnerable /wp-json/elicus/v1/dipl-modules/svg-animator REST route accepts an svg_image value. In affected versions, the route’s permission callback allows public access, while text sanitization does not restrict filesystem paths, stream wrappers, or arbitrary URLs. The value is passed into file-reading logic and the response body is returned in the endpoint’s JSON output.

An unauthenticated attacker can therefore retrieve files readable by the PHP process. Exposure of wp-config.php, environment files, private keys, logs, or backups can reveal database credentials and authentication material. Whether that leads to remote code execution depends on the files present and the surrounding server configuration.

Immediate remediation

1. Update Divi Plus to 2.4.1 or later.
2. If the patch cannot be applied immediately, deactivate Divi Plus and keep it inactive until the update is installed.
3. Purge WordPress, server, and CDN caches after updating.
4. Rotate WordPress database credentials, salts, API keys, and other secrets if logs show suspicious requests to the affected endpoint or if exposure cannot be ruled out.
5. Review administrator accounts, active sessions, modified files, and outbound connections before returning a suspected site to service.

Verify the plugin version

wp plugin get divi-plus --fields=name,version,status

If a customized installation uses a different slug, list active plugins and locate Divi Plus:

wp plugin list --status=active --fields=name,version,status

Compromise checks

• Search access and WAF logs for unexpected anonymous requests to /wp-json/elicus/v1/dipl-modules/svg-animator.
• Review response sizes and repeated requests that may indicate file enumeration.
• Check for new administrator users, unfamiliar application passwords, modified plugins or themes, unexpected scheduled tasks, and recently created PHP files.
• Compare wp-config.php and environment secrets against known-good backups, then rotate exposed values rather than merely restoring the file.
• Review database and hosting logs for access using credentials stored on the WordPress server.

Verification after remediation

1. Confirm Divi Plus 2.4.1 or later is active.
2. Test legitimate Divi Plus SVG Animator content and other affected modules after the update.
3. Run WordPress core and plugin integrity checks where vendor checksums are available.
4. Keep endpoint, authentication, and outbound-connection logs under enhanced review after rotating any potentially exposed secrets.

Exploitation status

Patchstack listed this vulnerability among recently exploited WordPress issues during this review. CVE-2026-91136 was not found in the CISA Known Exploited Vulnerabilities catalog at review time. The combination of unauthenticated access and sensitive file disclosure makes immediate patching and log review appropriate even where no compromise is visible.

Sources

• Wordfence Intelligence vulnerability record
• Patchstack vulnerability record
• Divi Plus 2.4.1 changelog
• CVE record for CVE-2026-91136
• NVD record for CVE-2026-91136

This advisory is based on disclosures from Wordfence, Patchstack, the CVE Program, and the plugin vendor. WPDeeply did not discover this vulnerability.