What is the CVSS score of EUVD-2026-42506?

EUVD-2026-42506 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Divi Form Builder are affected by EUVD-2026-42506?

The Divi Form Builder WordPress plugin (versions ≤5.1.8) contains a critical privilege escalation flaw (CVE-2026-5523, CVSS 8.8) enabling subscribers and higher-privileged users to hijack arbitrary…

How to fix or mitigate EUVD-2026-42506?

Within 24 hours: Inventory WordPress installations running Divi Form Builder; identify those on versions 5.1.8 or earlier; disable the plugin if not operationally critical; suspend new subscriber account provisioning. Within 7 days: Check Divi vendor security advisories and Wordfence for patch timeline; implement least-privilege access controls restricting subscriber role permissions; enable comprehensive audit logging on account modifications and password changes. Within 30 days: Apply vendor patch to latest Divi Form Builder version immediately upon release; conduct forensic audit of account modification logs from January 2026 onward; mandate multi-factor authentication for all administrative accounts.

Divi Form Builder EUVD-2026-42506

| CVE-2026-5523 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-09 Wordfence

GHSA-c9hw-vrgh-hh3m

WordPress Authentication Bypass Divi Form Builder Divi Engine

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 06:02 vuln.today

CVE Published

Jul 09, 2026 - 04:32 cve.org

HIGH 8.8

DescriptionCVE.org

The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the update_user() function accepting a user ID parameter from form submissions without verifying that the authenticated user has permission to edit that specific user account, and the handle_register_submission() function only checking if any user is logged in rather than validating permissions for the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to change the email address and password of any user account, including administrators, resulting in complete account takeover.

AnalysisAI

Privilege escalation to full account takeover in the Divi Form Builder WordPress plugin (versions up to and including 5.1.8) lets any authenticated user with subscriber-level access or higher change the email address and password of arbitrary accounts, including administrators. The flaw is an insecure direct object reference where a user ID supplied in a form submission is trusted without an authorization check. Reported by Wordfence and rated CVSS 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.