CVE-2020-35945: Elegantthemes Divi

High severity, CVSS 8.8. EPSS: 2.5% chance of exploitation in the next 30 days.

An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the client side.

Affected products

• Elegantthemes Divi: from 3.0, before 4.5.3 (fixed in 4.5.3)
• Elegantthemes Divi Builder: from 2.0, before 4.5.3 (fixed in 4.5.3)
• Elegantthemes Extra: from 2.0, before 4.5.3 (fixed in 4.5.3)

Published 2021-01-01. Last modified 2026-06-17.