Divi Plus CVE-2026-91136

No special conditions - remote unauthenticated exploitation against default configurations of the Divi Plus plugin (versions up to and including 2.4.0), because the SVGAnimatorController::index_permission callback returns true unconditionally and no authentication, user interaction, or non-default setting is required. The only prerequisite is that the target WordPress site has Divi Plus ≤2.4.0 installed and active with its REST routes reachable. Limiting factors are minimal: successful file read depends on the web server's filesystem permissions for the PHP process and on PHP allowing the file:// stream wrapper / outbound requests for the wp_remote_get() fallback; exploitation is otherwise unrestricted.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 HIGH) is internally consistent with the description: the vulnerable /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint has a permission callback (SVGAnimatorController::index_permission) that returns true unconditionally, confirming genuine unauthenticated network reach (PR:N, UI:N) and low attack complexity (AC:L) since a single crafted request suffices. The high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) matches an arbitrary file read primitive rather than code execution - the description's claim that this 'may make remote code execution possible' is speculative escalation, not demonstrated, and should not be treated as confirmed RCE. No EPSS score was provided in the input, so exploitation probability cannot be quantified. This is NOT in CISA KEV and no public exploit was referenced, so the status is no public exploit identified at time of analysis - do not treat it as actively exploited. Overall this is a legitimately actionable issue (trivial, unauthenticated, default-config file disclosure that can leak wp-config.php and secrets), not merely a high-CVSS-but-low-real-risk item; the main uncertainty is real-world install volume of this specific third-party add-on and the absence of EPSS/exploit telemetry to gauge opportunistic scanning.

An unauthenticated attacker sends a crafted GET/POST request to /wp-json/elicus/v1/dipl-modules/svg-animator with the 'svg_image' parameter set to a local path (or file:// URL), and because the permission callback always returns true and sanitization does not restrict filesystem paths, the server reads the target file and returns its raw contents in the JSON 'html' field. The attacker retrieves wp-config.php to harvest database credentials and WordPress salts. No public exploit was referenced, but the low complexity (AV:N/AC:L/PR:N) makes weaponization trivial.