Divi Plus
Monthly
Unauthenticated arbitrary file read affects the Divi Plus plugin for WordPress through version 2.4.0, letting any remote attacker retrieve files from the web server via the svg_image parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The endpoint's permission callback returns true unconditionally and the input checks used (sanitize_text_field() and esc_html()) do not block filesystem paths, the file:// stream wrapper, or arbitrary URLs, so the raw contents of the targeted file are returned in the JSON 'html' field; the issue is rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was provided, but successful reads of sensitive files such as wp-config.php could enable follow-on remote code execution.
Unauthenticated arbitrary file read affects the Divi Plus plugin for WordPress through version 2.4.0, letting any remote attacker retrieve files from the web server via the svg_image parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The endpoint's permission callback returns true unconditionally and the input checks used (sanitize_text_field() and esc_html()) do not block filesystem paths, the file:// stream wrapper, or arbitrary URLs, so the raw contents of the targeted file are returned in the JSON 'html' field; the issue is rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was provided, but successful reads of sensitive files such as wp-config.php could enable follow-on remote code execution.