What is the CVSS score of CVE-2026-5118?

CVE-2026-5118 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-5118?

WITHIN 24 HOURS: Inventory all WordPress installations; disable public user registration in Settings > General or immediately deactivate the Divi Form Builder plugin if versions ≤5.1.2 are detected. WITHIN 7 DAYS: If plugin functionality is required, restrict registration form access to authenticated users only; deploy WAF rules blocking POST requests with suspicious role parameters; enable logging and alerting on new administrator account creation. WITHIN 30 DAYS: Monitor Divi security advisories daily; apply vendor patch immediately upon release to versions >5.1.2; conduct forensic audit of administrator account creation timestamps and login patterns for compromise indicators.

Divi Form Builder CVE-2026-5118

EUVD-2026-31270 CRITICAL

Improper Privilege Management (CWE-269)

2026-05-21 Wordfence

GHSA-75vq-ppvv-frh3

WordPress Privilege Escalation

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 13:00 vuln.today

DescriptionCVE.org

The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.

AnalysisAI

Privilege escalation in the Divi Form Builder WordPress plugin (versions ≤5.1.2) allows unauthenticated remote attackers to register administrator accounts by submitting a tampered 'role' parameter in the registration POST body. The plugin trusts the client-supplied role value instead of enforcing the form's configured default_user_role, yielding full WordPress site takeover. No public exploit identified at time of analysis, but the CVSS 9.8 score and trivial exploitability make this a high-priority patch for any site running the plugin with public registration forms.

Technical ContextAI

The vulnerability resides in Divi Form Builder, a commercial WordPress plugin from Divi Engine (CPE cpe:2.3:a:divi_engine:divi_form_builder:*:*:*:*:*:*:*:*) that provides drag-and-drop registration forms integrated with the Divi page builder ecosystem. WordPress exposes a wp_insert_user() / wp_create_user() workflow where the 'role' meta is normally hard-coded by the calling form handler; here the plugin reads the 'role' field directly from $_POST without comparing it to the form's stored default_user_role configuration. This is a textbook CWE-269 (Improper Privilege Management) issue - a mass-assignment style flaw where a security-sensitive attribute is sourced from untrusted client input rather than server-side configuration.

RemediationAI

Patch available per vendor advisory - consult the Divi Engine changelog at https://diviengine.com/divi-form-builder-changelog/ for the fixed release post-5.1.2 and upgrade immediately; a specific patched version is not independently confirmed from the provided references. Until upgrade, mitigate by disabling or deactivating any Divi Form Builder registration forms exposed to unauthenticated users (this removes the registration capability for legitimate signups), or restrict access to the WordPress registration endpoint via a WAF rule that strips the 'role' POST parameter on requests to admin-ajax.php and the plugin's form handler URLs. Operators should also audit wp_users for newly created accounts with administrator role and review wp_usermeta for unexpected role assignments since the plugin was installed. Wordfence customers receive virtual patching via firewall rules; details at https://www.wordfence.com/threat-intel/vulnerabilities/id/72154404-f956-4ea2-96ec-166ade87885f?source=cve.