CVE-2026-5523
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Divi Form Builder plugin for WordPress up to version 5.1.8 has an authorization bypass vulnerability. The update_user() function accepts a user ID from form submissions without verifying permissions, and handle_register_submission() only checks if a user is logged in, not if they can edit the target account. This allows authenticated attackers with subscriber-level access or higher to change the email and password of any user, including administrators, leading to full account takeover.
Risk Assessment
The organization faces complete takeover of admin accounts by regular users, potentially leading to unauthorized data access, website content modification, and further attacks on the infrastructure.
Recommendation
Immediately update the Divi Form Builder plugin to the latest available version that fixes this vulnerability. As a temporary measure, disable the plugin or restrict access to registration forms until the update is applied.
Other vulnerabilities in Divi Form Builder
See all- CVE-2026-5524Critical
The Divi Form Builder plugin for WordPress up to version 5.1.8 is vulnerable to arbitrary file upload leading to remote code execution. The issue is due to insufficient file extension validation in the do_image_upload() function, where the acceptFileTypes POST parameter is directly interpolated into a regular expression. Attackers can upload files with .phtml, .phar, .php5, or .php7 extensions, bypassing .htaccess protection that only blocks .php files.
- CVE-2026-5118Critical
The Divi Form Builder plugin for WordPress up to version 5.1.2 allows privilege escalation. It accepts a user-controlled 'role' parameter from POST data during registration without validating it against the form's default_user_role setting, enabling unauthenticated attackers to create administrator accounts.
Original NVD description (English source)
The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the update_user() function accepting a user ID parameter from form submissions without verifying that the authenticated user has permission to edit that specific user account, and the handle_register_submission() function only checking if any user is logged in rather than validating permissions for the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to change the email address and password of any user account, including administrators, resulting in complete account takeover.