CVE-2026-91136: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Divi Essential Divi Plus

CVE-2026-91136 is a path traversal vulnerability (CWE-22) in the Divi Plus plugin for WordPress, affecting versions up to 2.4.0. The vulnerability exists in the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint where the 'svg_image' parameter is processed without proper validation. The permission callback always returns true, allowing unauthenticated access. Input sanitization functions used do not prevent filesystem path traversal or access to file:// streams. The parameter value is passed to file_get_contents() (with a fallback to wp_remote_get()), and the raw file content is returned in the JSON response, enabling arbitrary file read on the server.

An unauthenticated attacker can read arbitrary files on the affected server, potentially exposing sensitive information such as configuration files, credentials, or other data. While the vulnerability itself does not directly allow code execution, the disclosure notes that remote code execution may be possible as a consequence of the information gained.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable REST endpoint if possible, or disable the Divi Plus plugin if it is not essential. Monitor vendor channels for updates and apply patches promptly once released.