EUVD-2026-31270
GHSA-75vq-ppvv-frh3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify site running Divi Form Builder
-
DeliveryLocate public registration form
-
ExploitSubmit registration POST with role=administrator
-
InstallPlugin creates admin account without validation
-
C2Log in to wp-admin as new administrator
-
ExecuteUpload malicious plugin or theme
-
ImpactAchieve full site and server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target WordPress site must have the Divi Form Builder plugin (≤5.1.2) installed AND have at least one user-registration form configured and published on a front-end page reachable by unauthenticated visitors; sites that license the plugin but use it only for contact/non-registration forms are not exposed via this code path. No authentication, no user interaction, and no special platform configuration beyond the registration form being live - the attacker only needs to add a 'role' field to the otherwise-legitimate registration POST. WordPress's global 'Anyone can register' setting does not gate this issue because the plugin handles the insertion itself rather than deferring to wp-login.php?action=register. |
| Impact | Signals are uniformly severe: CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates remote, unauthenticated, low-complexity attack with full CIA impact, and CWE-269 privilege escalation to admin equates to complete WordPress site compromise. EPSS and CISA KEV data were not provided in the input, so probabilistic exploitation likelihood and confirmed in-the-wild abuse cannot be cited here, though Wordfence-disclosed WordPress plugin auth/registration flaws historically attract opportunistic mass scanning within days of disclosure. The only meaningful real-world limiter is that the site must have a public-facing Divi Form Builder registration form deployed - plugin installations that exist but expose no registration form on the front end are not directly reachable. Given the trivial exploit (a single crafted POST), this should be treated as a real priority rather than a theoretical high-CVSS issue. |
| Exploit ScenarioDerived | An attacker locates a WordPress site running Divi Form Builder with a public registration form, intercepts a normal signup submission in a proxy, appends or modifies a 'role=administrator' field in the POST body, and resubmits. The plugin creates the account with administrator privileges, after which the attacker logs in and uploads a malicious plugin or theme to achieve full code execution on the host. No public exploit was identified at time of analysis, but the attack requires only a standard HTTP client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 21, 2026
Privilege escalation in the Divi Form Builder WordPress plugin (versions ≤5.1.2) allows unauthenticated remote attackers to register administrator accounts by submitting a tampered 'role' parameter in the registration POST body. The plugin trusts the client-supplied role value instead of enforcing the form's configured default_user_role, yielding full WordPress site takeover. No public exploit identified at time of analysis, but the CVSS 9.8 score and trivial exploitability make this a high-priority patch for any site running the plugin with public registration forms.
RemediationAI
Patch available per vendor advisory - consult the Divi Engine changelog at https://diviengine.com/divi-form-builder-changelog/ for the fixed release post-5.1.2 and upgrade immediately; a specific patched version is not independently confirmed from the provided references. Until upgrade, mitigate by disabling or deactivating any Divi Form Builder registration forms exposed to unauthenticated users (this removes the registration capability for legitimate signups), or restrict access to the WordPress registration endpoint via a WAF rule that strips the 'role' POST parameter on requests to admin-ajax.php and the plugin's form handler URLs. Operators should also audit wp_users for newly created accounts with administrator role and review wp_usermeta for unexpected role assignments since the plugin was installed. Wordfence customers receive virtual patching via firewall rules; details at https://www.wordfence.com/threat-intel/vulnerabilities/id/72154404-f956-4ea2-96ec-166ade87885f?source=cve.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Divi Form Builder, a commercial WordPress plugin from Divi Engine (CPE cpe:2.3:a:divi_engine:divi_form_builder:*:*:*:*:*:*:*:*) that provides drag-and-drop registration forms integrated with the Divi page builder ecosystem. WordPress exposes a wp_insert_user() / wp_create_user() workflow where the 'role' meta is normally hard-coded by the calling form handler; here the plugin reads the 'role' field directly from $_POST without comparing it to the form's stored default_user_role configuration. This is a textbook CWE-269 (Improper Privilege Management) issue - a mass-assignment style flaw where a security-sensitive attribute is sourced from untrusted client input rather than server-side configuration.
Know when Divi Form Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.
Executive ViewAI
Divi Form Builder WordPress plugin versions 5.1.2 and earlier allow unauthenticated attackers to create administrator accounts through a role parameter manipulation flaw, resulting in complete WordPress site takeover. Any organization operating this plugin with public registration exposed faces immediate risk of credential compromise, content defacement, malware injection, and data exfiltration.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable public registration entirely via WordPress admin panel; (2) Restrict plugin access to authenticated users only if registration forms are business-essential; (3) Deploy WAF rules validating role parameter values; (4) Enable real-time alerts on administrator account creation; (5) Implement IP whitelisting for registration endpoints where operationally feasible; (6) Conduct immediate audit of existing administrator accounts for suspicious creation dates or sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Divi Form Builder
View allArbitrary file upload leading to remote code execution in the Divi Form Builder WordPress plugin (versions through 5.1.8
Privilege escalation to full account takeover in the Divi Form Builder WordPress plugin (versions up to and including 5.
Exploit-DB