What is the CVSS score of CVE-2026-1829?

CVE-2026-1829 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Content Visibility for Divi Builder are affected by CVE-2026-1829?

The Content Visibility for Divi Builder WordPress plugin (versions 4.02 and earlier) allows authenticated contributors and administrators to execute arbitrary PHP code on the server, creating a…

How to fix or mitigate CVE-2026-1829?

24 hours: Disable the Content Visibility for Divi Builder plugin on all WordPress instances if not mission-critical; audit all user accounts with Contributor role or higher and remove unnecessary permissions. 7 days: Implement Web Application Firewall rules to block requests containing 'cvdb_content_visibility_check' parameters; review WordPress access logs for suspicious Contributor-level activity in the past 30 days. 30 days: Monitor plugin vendor and Wordfence for a security patch release; apply immediately to all affected WordPress instances when available; if no patch is released by day 30, evaluate replacement plugins or maintain the plugin in disabled state.

Content Visibility for Divi Builder CVE-2026-1829

EUVD-2026-33993 HIGH

Code Injection (CWE-94)

2026-06-02 Wordfence

GHSA-hqhf-c4j5-73hq

RCE WordPress Code Injection

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 20:23 vuln.today

CVE Published

Jun 02, 2026 - 17:28 nvd

HIGH 8.8

DescriptionCVE.org

The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via the 'et_pb_text' shortcode 'cvdb_content_visibility_check' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

AnalysisAI

Remote code execution in the Content Visibility for Divi Builder WordPress plugin (versions ≤ 4.02) allows authenticated attackers with Contributor-level access or higher to execute arbitrary PHP on the server by abusing the 'cvdb_content_visibility_check' parameter of the 'et_pb_text' shortcode. The flaw is a CWE-94 code injection issue disclosed by Wordfence and carries a CVSS 3.1 score of 8.8. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The vulnerable component is a third-party WordPress plugin (jhorowitz/content_visibility_for_divi_builder per the CPE) that extends the Divi Builder page builder with conditional content visibility logic. The plugin registers an 'et_pb_text' shortcode handler whose 'cvdb_content_visibility_check' parameter is evaluated unsafely on the server, matching CWE-94 (Improper Control of Generation of Code, i.e., code injection). The trac source reference (plugin.class.php at line 229 of tag 4.01) points to the conditional-evaluation routine where the parameter is passed into a PHP execution sink rather than being sandboxed or strictly validated, allowing the supplied expression to be interpreted as PHP at shortcode-render time.

RemediationAI

Upstream fix available via WordPress.org plugin trac changeset 3543621 (https://plugins.trac.wordpress.org/changeset/3543621/content-visibility-for-divi-builder); a released patched version above 4.02 is not independently confirmed in the supplied data, so administrators should update Content Visibility for Divi Builder to the latest version published on WordPress.org and verify the installed version is greater than 4.02. Until patched, compensating controls include temporarily deactivating the Content Visibility for Divi Builder plugin (trade-off: any pages relying on its conditional visibility logic will render unfiltered), tightening user-role hygiene by auditing and removing untrusted Contributor/Author accounts and disabling open user registration (trade-off: friction for legitimate contributors), and placing a WAF rule in front of WordPress to block requests whose shortcode payloads contain 'cvdb_content_visibility_check' with PHP-like expressions (trade-off: rule must be tuned to avoid breaking legitimate post submissions). Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2ea89c44-8ed0-4ab7-a049-4d1b03a898c7?source=cve for detection signatures.