Divi Plus Plugin Flaw Disclosed: Update to Stay Ahead of Attackers
A serious security flaw in the Divi Plus plugin could let strangers read sensitive files from your server without even logging in. The Divi Plus plugin vulnerability — tracked as CVE-2026-91136 and rated 7.5 out of 10 — was disclosed on October 10, 2026, and a public proof-of-concept exploit is already circulating. If your site uses the Divi Plus plugin, updating to version 2.4.1 is the single most important thing you can do today.
What Happened: the Divi Plus Plugin File-Read Flaw
The Divi Plus plugin flaw lives in the plugin’s SVG Animator module — a Divi builder extension by Elicus (Divi Extended) that lets designers animate SVG graphics. The problem is a REST API endpoint at /wp-json/elicus/v1/dipl-modules/svg-animator that accepts an svg_image parameter and fetches whatever that parameter points to.
Two mistakes combined to make the Divi Plus plugin dangerous:
- The endpoint’s permission callback — SVGAnimatorController::index_permission — returns true unconditionally, meaning the endpoint answers requests from unauthenticated visitors, not just logged-in users.
- The svg_image input was run through sanitize_text_field() and esc_html() before being handed to file_get_contents() (with a wp_remote_get() fallback). Those sanitization functions strip HTML and whitespace, but they do nothing to restrict filesystem paths, the file:// stream wrapper, or remote URLs. The raw response body was then returned in the JSON response’s html field.
In practice, an attacker can request something like /wp-json/elicus/v1/dipl-modules/svg-animator?svg_image=/etc/passwd — and the server obliges, reading the file and handing the contents back. From there, an attacker can read wp-config.php (your database credentials and secret keys), .env files, server configuration, or even cloud instance metadata through server-side requests to addresses like 169.254.169.254. A file-read flaw of this kind can escalate toward remote code execution, because exposed credentials and keys are often all an attacker needs.
The Wordfence threat intelligence entry catalogued the flaw on October 10, 2026, the same day the CVE record was created, and CISA’s coordinator role added an SSVC assessment noting the vulnerability is network-reachable and automatable. The EPSS score currently sits around 1.78% — modest in absolute terms, but a public GitHub proof-of-concept and a ready-made Nuclei scanning template mean mass scanning of the WordPress ecosystem is cheap and easy. Scanners do not care how small your site is.
Who Is Affected by the Divi Plus Plugin Vulnerability
The Divi Plus plugin vulnerability affects every site running Divi Plus version 2.4.0 or earlier. Divi Plus is a popular premium add-on for the Divi theme and builder — sites using it for extra modules, the SVG animator, or other design extensions are all in scope.
What makes this flaw especially serious is the “unauthenticated” part. Most plugin vulnerabilities require at least a subscriber or contributor account to exploit; this one requires nothing at all. No login, no account, no prior interaction — any computer on the internet can send the request directly. That property puts every unpatched site in the scanner’s crosshairs the moment public exploit code exists, which it now does.
The fix is Divi Plus version 2.4.1 or later. Check your version under Dashboard → Plugins and update immediately. The vendor’s changelog documents the patch, and security aggregators now advise updating to v2.4.1+ as the only reliable remediation.
Why the Divi Plus Plugin Flaw Matters
Arbitrary file-read flaws are among the most underrated vulnerability classes in WordPress. They rarely look dramatic — there is no defacement, no spam injection, no obvious sign anything happened. But a single successful read of wp-config.php hands an attacker your database username and password, your table prefix, and your authentication salts. With database credentials, an attacker can read customer records, insert malicious admin users, or pivot further. With cloud metadata, the attack can escape the site entirely and reach the hosting account.
The disclosure also illustrates a pattern security teams keep flagging: sanitization is not validation. Running user input through sanitize_text_field() looks like responsible coding, but when the input is used as a filesystem path or URL, only an allowlist of expected values — or outright rejection of path-like input — actually closes the hole. Plugin developers shipping REST endpoints should treat every parameter as hostile until proven otherwise, and site owners should remember that sanitized code can still be vulnerable code.
There is a broader lesson for Divi-based sites too. Page-builder add-ons are premium, feature-rich, and trusted with deep integration into your site — which is exactly why flaws in them carry outsized risk. The Divi ecosystem has seen several file-upload and file-inclusion issues across its add-ons this year alone. Each one reinforces the same advice: keep every premium plugin current, and treat update notifications for builder add-ons as high priority.
What to Do Now About the Divi Plus Plugin Flaw
If you run the Divi Plus plugin, work through these steps today:
- Update to Divi Plus 2.4.1 or later. Go to Dashboard → Updates or Dashboard → Plugins, and apply the update. Verify the new version number shows after the update completes.
- Check whether you were exposed. Because this attack leaves little trace in normal logs, look for suspicious requests to /wp-json/elicus/v1/dipl-modules/svg-animator in your access logs, especially with svg_image values pointing at /etc/passwd, wp-config.php, or .env. If your host provides a firewall or security scanner, run it now.
- Rotate secrets if there is any sign of probing. If you find evidence of exploitation attempts — or simply cannot rule them out — change your database password, regenerate WordPress salts, and update any API keys stored in wp-config.php or .env files. Exposed credentials stay useful to attackers long after the patch.
- Enable automatic updates for plugins. Divi Plus supports auto-updates like any WordPress plugin. Turning them on for this and other premium add-ons closes the window between disclosure and patching to hours instead of weeks.
- Scan for unexpected files and users. File-read flaws sometimes precede deeper compromise. Check for new administrator accounts, unfamiliar files in wp-content/uploads, and scheduled tasks you did not create.
Divi Plus Plugin: Frequently Asked Questions
What is the Divi Plus plugin vulnerability?
The Divi Plus plugin vulnerability (CVE-2026-91136, CVSS 7.5) is an unauthenticated arbitrary file-read flaw in the SVG Animator REST endpoint of Divi Plus versions up to and including 2.4.0. Attackers can read server files such as wp-config.php without logging in.
Which versions of the Divi Plus plugin are affected?
All versions up to and including 2.4.0. The flaw is fixed in version 2.4.1 — update to 2.4.1 or later to be protected.
Is the Divi Plus plugin flaw being exploited?
Public proof-of-concept code and a Nuclei scanning template are available, and the vulnerability is rated as network-reachable and automatable. While no mass-exploitation campaign has been confirmed in CISA’s known-exploited catalog, the ingredients for one are all present — which is exactly why updating now matters.
How does the Divi Plus plugin file-read attack work?
An attacker sends an unauthenticated request to the /wp-json/elicus/v1/dipl-modules/svg-animator endpoint with the svg_image parameter set to a filesystem path (like /etc/passwd) or a file:// URL. The plugin reads the file and returns its contents in the JSON response.
What should I do if I cannot update the Divi Plus plugin right away?
Disable the plugin until you can update. A disabled plugin cannot serve the vulnerable endpoint. Then update to 2.4.1+ and re-enable it, and consider blocking requests to /wp-json/elicus/v1/ at the firewall level as a temporary measure.
Conclusion
The Divi Plus plugin disclosure is a textbook example of why patch speed matters more than ever in the WordPress ecosystem. A premium add-on used on countless Divi sites shipped a REST endpoint that answered strangers’ requests and read server files on demand — and within days, working exploit code was public. The good news is the fix is simple: Divi Plus 2.4.1 closes the hole completely, and the update takes minutes. The bad news is that every hour of delay is an hour in which automated scanners can find your site, read your configuration, and harvest credentials that outlive the vulnerability itself. Do not wait for an attack to be confirmed against your site — by then, the damage is done.
If keeping up with disclosures like this feels like a second job, it is because it nearly is. Qamar Digital Ventures helps businesses stay secure and grow online. Our website care plans handle updates, security monitoring, and hardening for you — so the next Divi Plus plugin advisory gets patched before it ever becomes your problem. Visit https://qamardigitalventuresllc.com/ to learn more, or contact us to discuss your project.
Sources
- Wordfence Threat Intelligence — CVE-2026-91136 (Divi Plus ≤ 2.4.0 unauthenticated arbitrary file read): https://www.wordfence.com/threat-intel/vulnerabilities/id/2c0bbdf6-afaf-4194-ada2-24d142892c32
- CVEFeed — CVE-2026-91136 record and timeline: https://cvefeed.io/vuln/detail/CVE-2026-91136
- TheHackerWire — CVE-2026-91136 PoC and EPSS analysis: https://www.thehackerwire.com/vulnerability/CVE-2026-91136/
- GitHub — fl0ydsec/CVE-2026-91136 proof-of-concept: https://github.com/fl0ydsec/CVE-2026-91136
