CVE-2026-91707: Divi WordPress Theme RCE Vulnerability

CVE-2026-91707 Overview

CVE-2026-91707 affects the Divi theme for WordPress in all versions up to and including 5.11.1. The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes because the theme fails to validate a value before passing it to do_shortcode. When the Force Enable D4 Shortcode Framework option is enabled, attackers can invoke the et_pb_contact_form shortcode to send email messages to attacker-selected recipients with attacker-controlled content. The flaw is categorized under CWE-862: Missing Authorization and stems from broken access control on a network-reachable action handler.

Critical Impact
Unauthenticated attackers can abuse vulnerable Divi installations as an outbound email relay for phishing or spam by invoking the contact form shortcode with attacker-controlled recipients and message bodies.

Affected Products

Divi theme for WordPress — all versions up to and including 5.11.1
WordPress sites with the Force Enable D4 Shortcode Framework option enabled (expanded impact scope)
Fixed in Divi 5.12.0

Discovery Timeline

2026-09-18 - CVE-2026-91707 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-91707

Vulnerability Analysis

The vulnerability is a missing authorization issue in an action handler exposed by the Divi theme. The handler accepts input from unauthenticated HTTP requests and forwards a value into the WordPress do_shortcode function without validating whether the caller should be permitted to invoke arbitrary shortcodes. WordPress do_shortcode parses and executes any registered shortcode contained in the supplied string, so any registered shortcode becomes reachable through this entry point.

Because Divi registers many shortcodes for its page builder, the attack surface is large. The most impactful example documented in the advisory is et_pb_contact_form. When the site administrator has toggled Force Enable D4 Shortcode Framework, this shortcode remains fully wired, allowing attackers to trigger contact form submissions server-side. The submission logic accepts an attacker-chosen recipient address and message content, effectively turning the site into an outbound mail relay.

Root Cause

The root cause is a missing authorization check [CWE-862] combined with insufficient input validation before invocation of do_shortcode. The vulnerable action does not verify a capability, nonce, or authentication state before treating user-controlled input as trusted shortcode markup.

Attack Vector

Exploitation requires only network access to the WordPress site. No authentication and no user interaction are required. An attacker sends a crafted HTTP request to the vulnerable action endpoint containing a shortcode payload. The server parses the payload and executes the shortcode with site-level context. Refer to the Wordfence Vulnerability Report #79a2fa3b for additional technical detail.

No verified proof-of-concept code is published for CVE-2026-91707.
Refer to the Wordfence advisory linked above for exploitation details.

Detection Methods for CVE-2026-91707

Indicators of Compromise

Outbound email from the WordPress host to recipients not associated with legitimate site traffic, particularly messages that appear to originate from the Divi contact form.
HTTP POST requests to WordPress admin-ajax.php or comparable action endpoints containing raw shortcode markup such as [et_pb_contact_form] in request parameters from unauthenticated sources.
Access log entries showing repeated unauthenticated requests to Divi action handlers from a small set of source IPs.
Complaints or bounce messages indicating the site is being used to send unsolicited email.

Detection Strategies

Inspect web server access logs for request bodies containing et_pb_ shortcode names originating from unauthenticated sessions.
Alert on any HTTP request to Divi endpoints whose parameters contain the literal [ and ] shortcode delimiters.
Correlate mail server send events with inbound HTTP requests to the WordPress host to identify request-driven email abuse.

Monitoring Recommendations

Monitor the installed Divi theme version and flag any host still running 5.11.1 or earlier.
Track the state of the Force Enable D4 Shortcode Framework option and alert when it is enabled on production sites.
Baseline normal outbound SMTP volume from web hosts and alert on deviations.

How to Mitigate CVE-2026-91707

Immediate Actions Required

Update the Divi theme to version 5.12.0 or later on all WordPress sites.
Disable the Force Enable D4 Shortcode Framework option unless it is explicitly required.
Review outbound mail logs for evidence of abuse and rotate any exposed contact form configuration.
Restrict access to WordPress action endpoints behind a web application firewall while patching is scheduled.

Patch Information

Elegant Themes fixed the issue in Divi 5.12.0. See the Divi 5.12.0 Update Information and the Divi Changelog Overview for release notes.

Workarounds

Turn off Force Enable D4 Shortcode Framework in the Divi theme options to remove the documented email-relay path.
Deploy a WAF rule that blocks unauthenticated requests containing shortcode delimiters in POST parameters targeting Divi action handlers.
Restrict outbound SMTP from the web host to an approved relay that enforces sender and recipient allowlists.

bash

# Example WAF rule concept: block unauthenticated POSTs to admin-ajax.php
# that contain Divi shortcode markup in the request body.
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:2026917070,msg:'Block Divi shortcode injection (CVE-2026-91707)'"
  SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain"
    SecRule REQUEST_BODY "@rx \[et_pb_[a-z_]+" "t:none"