Threats tagged 'ghsa-9676-xmxf-xp84'

The Divi Plus WordPress plugin versions up to and including 2.4.0 contain a path traversal vulnerability in the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This flaw allows unauthenticated attackers to read arbitrary files on the server by exploiting insufficient validation of the 'svg_image' parameter. The endpoint's permission callback returns true unconditionally, and sanitization functions used do not prevent access to filesystem paths or URLs. This vulnerability has a high severity rating with a CVSS score of 7.5.