Executive brief
The Divi WordPress theme allows unauthenticated attackers to execute arbitrary shortcodes due to insufficient validation of user input before processing shortcode actions. When the optional 'Force Enable D4 Shortcode Framework' setting is enabled, attackers can abuse the contact form shortcode to send emails to arbitrary recipients with attacker-controlled content, potentially enabling phishing or spam campaigns against site visitors and owners.
Technical details
This vulnerability is a missing input validation flaw in the Divi theme's shortcode processing. The vulnerable code accepts user-supplied input and passes it to WordPress's do_shortcode() function without proper sanitization or validation. The attack is unauthenticated and network-accessible; no user interaction is required. When the D4 Shortcode Framework is enabled, attackers can specifically invoke the et_pb_contact_form shortcode to manipulate email routing and content. A patch is available in version 5.12.0 and later.
Affected products
- Elegant Themes Divi up to and including 5.11.1
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in version 5.12.0