Divi Membership CVE-2026-19660

No special conditions - remote unauthenticated exploitation against default configurations of the Divi Membership plugin (all versions ≤2.3.0). The only prerequisite is that a target WordPress user ID exists (e.g., administrator ID 1); the attacker supplies it via the base64-encoded paypal_param GET parameter. Notably, exploitation does NOT require PayPal to be enabled or configured, because the PayPal gateway class is instantiated unconditionally and its process_paypal_callback is hooked to init on every front-end request. The only limiting factor is that the site must run the Divi Membership plugin at a vulnerable version; there is no user interaction, authentication, or non-default setting required.

This is a genuine top-priority vulnerability, not an inflated CVSS score. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) is fully consistent with the description: a base64-encoded paypal_param GET parameter passed directly to wp_set_current_user() and wp_set_auth_cookie() with no IPN validation, signature check, ownership check, or nonce, yielding trivial unauthenticated login as any user including administrators. The signals are internally coherent - network vector, low complexity, no privileges, no user interaction, and full C/I/A impact all align with a one-request auth bypass leading to site takeover. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk rating therefore rests on exploit simplicity and the ubiquity of WordPress attack automation rather than confirmed in-the-wild activity. The compounding factor that the PayPal gateway class is instantiated unconditionally - registering the vulnerable init hook on every front-end request regardless of PayPal configuration - removes the usual 'only if the feature is enabled' mitigation and raises real-world exposure for all installs. Missing data: EPSS, KEV, and POC status are all absent and should be monitored, as the low exploitation barrier makes rapid weaponization likely once details circulate.

An unauthenticated attacker sends a single front-end GET request containing a base64-encoded paypal_param value that embeds the user ID 1 (the typical administrator). The vulnerable process_paypal_callback function, registered on every request, trusts the attacker-supplied ID and issues a valid authentication cookie, logging the attacker in as that administrator. No public exploit code was provided in the input, but the attack requires only a crafted URL and is trivially reproducible.