CVE-2026-5118
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The Divi Form Builder plugin for WordPress up to version 5.1.2 allows privilege escalation. It accepts a user-controlled 'role' parameter from POST data during registration without validating it against the form's default_user_role setting, enabling unauthenticated attackers to create administrator accounts.
Risk Assessment
Unauthenticated attackers can gain full administrative access to the WordPress site, leading to complete takeover of the site and its data.
Recommendation
Update the Divi Form Builder plugin to the latest available version that fixes this vulnerability.
Original NVD description (English source)
The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.