Threat database

The Divi Plus WordPress plugin versions up to and including 2.4.0 contain a path traversal vulnerability in the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This flaw allows unauthenticated attackers to read arbitrary files on the server by exploiting insufficient validation of the 'svg_image' parameter. The endpoint's permission callback returns true unconditionally, and sanitization functions used do not prevent access to filesystem paths or URLs. This vulnerability has a high severity rating with a CVSS score of 7.5.

The Divi Essential plugin for WordPress up to version 5.8.1 contains a missing authorization vulnerability. Authenticated users with Subscriber-level access or higher can exploit this flaw via AJAX actions to enumerate database tables and read sensitive data. The vulnerability arises because nonce verification is conditional and easily bypassed, and no capability checks are enforced. This allows exposure of sensitive information such as usernames, emails, hashed passwords, session tokens, secret keys, and privileged settings stored in the database.