Divi Membership CVE-2026-19652

Exploitation requires that a page rendering the Divi Membership registration form be reachable, because the dmem_form_submit_handler() role-selection logic (which calls password_verify() on the attacker-controlled form_id bcrypt hash against every WordPress role with no role whitelist) is the vulnerable path, and the registration form page is where the required WordPress nonce is publicly emitted. The nonce is the only prerequisite and imposes no real limit since any unauthenticated visitor can read it; immediate authentication additionally requires submitting auto_login=on. The practical limiting factors are therefore deployment-specific: the plugin must be installed at version ≤2.2.0 and the registration form must be exposed on a publicly accessible page - there is no authentication, user interaction, or non-default toggle needed beyond that.

This is a genuine high-priority vulnerability, not an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is fully consistent with the description: an unauthenticated network attacker can achieve administrator-role registration and immediate authentication in a single request, giving C:H/I:H/A:H and justifying the 9.8 base score. The design flaw is especially dangerous because the sole apparent gate - a WordPress nonce - is publicly emitted on any page rendering the registration form, so it provides no meaningful barrier; this collapses what might look like a configuration-dependent weakness into effectively unauthenticated full takeover wherever the registration form is exposed. Signals are limited, however: no EPSS score was provided, there is no CISA KEV listing, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis' despite the trivial, deterministic nature of the attack. The main limiting factor is deployment - exploitation only works where the Divi Membership registration form is actually rendered and reachable. Given how mechanically simple and reliable the attack is once a vulnerable, exposed site is found, defenders should treat this as urgent for any site running the plugin even though no in-the-wild activity is confirmed in the provided data.

An unauthenticated attacker loads a WordPress page that renders the Divi Membership registration form, scrapes the publicly emitted nonce, and submits a registration request with the form_id parameter set to a locally computed bcrypt hash of the string 'administrator' plus auto_login=on. The server's role-matching loop verifies the hash against the administrator role, creates the account with admin privileges, and immediately authenticates the attacker in the same request, yielding full site takeover. No public exploit code is identified at time of analysis, but the technique is deterministic and requires only commodity bcrypt tooling.