CVE-2026-91136 Scanner

Divi Plus is a popular WordPress plugin used by website designers and developers to enhance the functionality of the Divi theme. It provides a range of modules and widgets to create custom layouts and features without coding. Divi Plus is widely used by WordPress users to create interactive and visually appealing websites. The plugin allows the incorporation of animations, sliders, and various design elements to enhance user experience. It is managed and developed by Elicus, who periodically update the plugin to introduce new features or security patches. Due to its extensive use, maintaining its security is crucial to protecting websites that rely on it.

The vulnerability identified is an Arbitrary File Read issue, which is a serious security flaw in the plugin. This vulnerability allows unauthorized attackers to exploit specific endpoints to read files on the server. The flaw exists due to improper validation of the file path, allowing attackers to access sensitive files. Affected versions of Divi Plus have a REST route that exposes file reading functionality with inadequate access controls. Attackers can leverage this vulnerability to read content from critical files, such as configuration files containing database credentials. Such vulnerabilities can lead to significant security breaches if not addressed promptly.

The technical details highlight that the vulnerability is present in the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The svg_image parameter is used without proper security checks, allowing an attacker to specify arbitrary files on the server. Unsanitized inputs could lead the system to execute file_get_contents() on unintended paths. The weakness lies in the lack of path restrictions, enabling attackers to read sensitive files residing on the server. This can expose critical information like database credentials and authentication keys. The endpoint returns file content if the files are readable by the web server user, posing significant security risks.

If exploited, this vulnerability can have various adverse effects on affected systems. Unauthorized file access could lead to information disclosure, exposing sensitive data like database credentials. Compromised credentials can allow attackers to breach databases, leading to data theft or manipulation. Further, reading configuration files can aid attackers in crafting more sophisticated attacks, such as privilege escalation or remote code execution. Exposure of sensitive files can compromise the integrity and confidentiality of affected websites, resulting in loss of trust and potential financial implications. Therefore, it is imperative to address this flaw to protect systems from potential exploits.

REFERENCES

• https://nvd.nist.gov/vuln/detail/CVE-2026-91136
• https://github.com/fl0ydsec/CVE-2026-91136