CVE-2026-5118
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The Divi Form Builder plugin for WordPress up to version 5.1.2 allows privilege escalation. It accepts a user-controlled 'role' parameter from POST data during registration without validating it against the form's default_user_role setting, enabling unauthenticated attackers to create administrator accounts.
Risk Assessment
Unauthenticated attackers can gain full administrative access to the WordPress site, leading to complete takeover of the site and its data.
Recommendation
Update the Divi Form Builder plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Divi Form Builder
See all- CVE-2026-5524Critical
The Divi Form Builder plugin for WordPress up to version 5.1.8 is vulnerable to arbitrary file upload leading to remote code execution. The issue is due to insufficient file extension validation in the do_image_upload() function, where the acceptFileTypes POST parameter is directly interpolated into a regular expression. Attackers can upload files with .phtml, .phar, .php5, or .php7 extensions, bypassing .htaccess protection that only blocks .php files.
- CVE-2026-5523High
The Divi Form Builder plugin for WordPress up to version 5.1.8 has an authorization bypass vulnerability. The update_user() function accepts a user ID from form submissions without verifying permissions, and handle_register_submission() only checks if a user is logged in, not if they can edit the target account. This allows authenticated attackers with subscriber-level access or higher to change the email and password of any user, including administrators, leading to full account takeover.
Original NVD description (English source)
The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS