CVE-2026-4275
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Divi Torque Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, bypassing WordPress's built-in nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the lack of nonce verification allows a forged request from a logged-in administrator's browser to pass the capability check via session cookies.
Risk Assessment
The risk is that an unauthenticated attacker can trick an administrator into making an unintended request, enabling remote installation of arbitrary plugins from the WordPress repository. This could lead to full site compromise by installing malicious software.
Recommendation
Immediately update the Divi Torque Lite plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin or apply WAF rules to block access to the /install_plugin and /activate_plugin endpoints.
Related vulnerabilities
- CVE-2026-84834Critical
Unauthenticated PHP Object Injection vulnerability in JobSearch versions up to 3.2.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.
- CVE-2026-84814Critical
Subscriber privilege escalation vulnerability in Bricksforge versions up to 3.1.8.8, allowing a subscriber to escalate privileges.
- CVE-2026-84813Critical
Unauthenticated SQL Injection vulnerability in GeoDirectory versions up to 2.8.174. An attacker can inject SQL queries, potentially leading to unauthorized database access.
- CVE-2026-84768Critical
Unauthenticated SQL Injection vulnerability in VikAppointments Services Booking Calendar versions up to 1.2.20. An attacker can inject SQL queries, potentially leading to unauthorized database access.
- CVE-2026-84753Critical
Unauthenticated PHP Object Injection vulnerability in Mail Mint versions up to 1.31.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.
- CVE-2026-84238Critical
Unauthenticated Broken Access Control vulnerability in YITH Request a Quote for WooCommerce Premium versions before 4.46.0. An attacker can access functions they should not have permission to.
- CVE-2026-85216Critical
MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. An attacker knowing a valid directory user's email address could submit an empty password, which may be accepted by an LDAP server allowing unauthenticated binds. Additionally, in the LinOTP component, empty passwords could be checked against local MISP password hashes, and LDAP-provisioned accounts could be created with empty local passwords.
- CVE-2026-85183Critical
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.
- CVE-2026-85181Critical
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.
- CVE-2026-85109Critical
A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Original NVD description (English source)
The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress's built-in REST API nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the absence of nonce verification means that a forged cross-site request from a logged-in administrator's browser will pass the capability check via the admin's session cookies. This makes it possible for unauthenticated attackers to install arbitrary plugins from WordPress.