Divi WordPress Theme CVE-2026-91707

Base shortcode-injection reachability requires no authentication, no user interaction, and works remotely against Divi <=5.11.1 via the action that passes an unvalidated value to do_shortcode. The specific email-abuse impact via et_pb_contact_form is additionally gated on the site having the non-default 'Force Enable D4 Shortcode Framework' option enabled; sites without that option are exposed to arbitrary shortcode execution but not this particular email vector. Impact is limited to integrity effects (email injection / shortcode side effects) - there is no confidentiality or availability impact per the vector, and no code execution is claimed.

This is a genuine but moderate-severity issue, correctly rated CVSS 5.3. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N is internally consistent with the description: an unauthenticated network attacker (PR:N/UI:N) can trigger do_shortcode on an insufficiently validated value with no confidentiality or availability impact and only limited integrity impact (I:L), which matches a mail-injection/spam-relay outcome rather than code execution or data theft. Exploitation status: no public exploit identified at time of analysis - Wordfence indexed it but there is no KEV listing, no EPSS score, and no POC in the provided references, so this is a disclosed-and-patched flaw rather than a confirmed exploited one. The most severe named consequence (invoking et_pb_contact_form to send attacker-controlled email to an attacker-chosen recipient) is gated on the non-default 'Force Enable D4 Shortcode Framework' option, so real-world impact is narrower than the unauthenticated/network profile alone suggests. Net: prioritize patching because Divi's install base is enormous, but this is not a critical RCE-class emergency - treat it as a medium priority spam/abuse and shortcode-injection exposure. No signals are strongly conflicting; the main uncertainty is that concrete impact beyond email abuse (which other shortcodes are reachable) is not enumerated in the available data.

An unauthenticated attacker sends a crafted request to a vulnerable Divi site triggering the action that calls do_shortcode on an unvalidated value, injecting arbitrary Divi shortcodes. On a site with 'Force Enable D4 Shortcode Framework' enabled, the attacker invokes et_pb_contact_form to send emails with attacker-controlled recipient and body, turning the site into a spam/phishing relay. No public exploit code is identified at time of analysis, and no authentication or user interaction is required.