What is the CVSS score of CVE-2026-4275?

CVE-2026-4275 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Divi Torque Lite are affected by CVE-2026-4275?

Divi Torque Lite WordPress plugin versions 4.2.3 and earlier contain a critical CSRF vulnerability that enables remote code execution if a site administrator can be tricked into visiting a malicious…

How to fix or mitigate CVE-2026-4275?

Within 24 hours: Identify all WordPress installations running Divi Torque Lite versions ≤ 4.2.3 and immediately deactivate the plugin. Within 7 days: Completely remove the plugin from all affected sites; implement WAF or .htaccess rules to restrict REST API plugin installation endpoints to authenticated administrators only. Within 30 days: Monitor Divi vendor releases for a security patch; upgrade to the patched version when available or replace with an alternative plugin solution.

Divi Torque Lite CVE-2026-4275

EUVD-2026-42563 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-09 Wordfence

GHSA-ggxj-99vw-g2xw

WordPress CSRF Wordpress Plugin Divi Torque Lite Divi Modules For The Divi Builder Theme

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network CSRF needs no attacker privileges (PR:N) but a forged request from an authenticated admin (UI:R); arbitrary plugin install yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:29 vuln.today

CVE Published

Jul 09, 2026 - 09:31 nvd

HIGH 8.8

DescriptionCVE.org

The Divi Torque Lite - Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress's built-in REST API nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the absence of nonce verification means that a forged cross-site request from a logged-in administrator's browser will pass the capability check via the admin's session cookies. This makes it possible for unauthenticated attackers to install arbitrary plugins from WordPress.

AnalysisAI

Cross-Site Request Forgery in the Divi Torque Lite WordPress plugin (versions ≤ 4.2.3) lets remote attackers install and activate arbitrary plugins by tricking a logged-in administrator into loading a malicious page. The plugin registers its /install_plugin and /activate_plugin REST routes with '__return_true' as the permission_callback, which suppresses WordPress's REST nonce check so a forged request rides the admin's session cookies past the internal capability check. No public exploit is identified at time of analysis, but installing an attacker-supplied plugin yields effective remote code execution on the site.

Technical ContextAI

The affected component is a WordPress plugin (vendor slug 'addons-for-divi', marketed as Divi Torque Lite) that exposes custom REST API endpoints via register_rest_route. In WordPress, the permission_callback is the security gate for a REST route and is also where the framework enforces nonce (CSRF token) validation for cookie-authenticated requests. By setting permission_callback to '__return_true' (visible in the source at includes/rest-api.php lines 75, 81 and 230), the plugin declares the route unconditionally permitted, which disables the automatic X-WP-Nonce verification. The endpoint handlers still call current_user_can(), but capability checks validate WHO is logged in, not whether the request was INTENTIONALLY issued - so they do not stop a cross-site forgery. This is the classic CWE-352 (Cross-Site Request Forgery) root cause: a state-changing action (plugin installation/activation) lacks an unpredictable, per-request anti-CSRF token.

RemediationAI

Update the Divi Torque Lite plugin to a version newer than 4.2.3 as soon as the vendor publishes a fixed release; the input identifies the flaw through 4.2.3 but does not confirm an exact patched version, so verify the current release against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/8be98cba-b891-42cf-8a6c-8fe05f27c9c3?source=cve) and the WordPress plugin changelog. The correct upstream fix is to replace the '__return_true' permission_callback with a callback that both checks capabilities and validates the REST nonce (as reflected in the trac changeset 3559041 for addons-for-divi). If a patched version is not yet available, compensating controls include deactivating the plugin entirely (removes the exploit surface but disables Divi Torque functionality), blocking or restricting access to the plugin's /install_plugin and /activate_plugin REST routes at a WAF or reverse proxy, and enforcing administrator hygiene - separate browsing sessions for admin work and short admin session lifetimes reduce the window in which a forged request can ride a live cookie. A Wordfence firewall rule may also virtually patch the endpoints pending an upgrade.