CVE-2026-5523: Divi Form Builder Auth Bypass Vulnerability

CVE-2026-5523 Overview

CVE-2026-5523 is a missing authorization vulnerability affecting the Divi Form Builder plugin for WordPress in all versions up to and including 5.1.8. The flaw resides in the update_user() and handle_register_submission() functions, which accept a user ID parameter from form submissions without validating whether the authenticated user has permission to modify the targeted account. Authenticated attackers holding subscriber-level access or higher can change the email address and password of arbitrary user accounts, including administrators. Successful exploitation leads to complete account takeover of the WordPress site [CWE-639].

Critical Impact
Any authenticated subscriber can hijack administrator accounts by modifying credentials, resulting in full WordPress site compromise.

Affected Products

Divi Form Builder plugin for WordPress, versions up to and including 5.1.8
WordPress sites using Divi Form Builder with user registration or profile update features enabled
Any WordPress installation permitting subscriber-level registration alongside the vulnerable plugin

Discovery Timeline

2026-07-09 - CVE-2026-5523 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-5523

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in the plugin's user management workflow. The update_user() function receives a user ID from client-supplied form data and processes account updates against that ID. It performs no capability check confirming the current session belongs to the target account or possesses edit_users rights.

The handle_register_submission() function contains a parallel weakness. It verifies only that a session is authenticated, not that the caller is authorized to act on the referenced user record. An attacker submitting a crafted request with the administrator's user ID can rewrite that administrator's email and password.

Attack requires network access, low complexity, and low privileges. No user interaction is needed. Compromise of a single low-privilege account cascades into full site takeover, database access, and persistence via administrative plugin or theme uploads.

Root Cause

The root cause is missing authorization enforcement on user-modification endpoints. Both vulnerable functions trust the user ID parameter transmitted in form submissions instead of deriving the target user from the authenticated session or verifying capability via current_user_can( 'edit_user', $user_id ).

Attack Vector

An attacker registers or obtains a subscriber account on a target WordPress site running Divi Form Builder 5.1.8 or earlier. The attacker crafts a form submission that supplies the administrator's user ID along with attacker-controlled email and password values. The plugin processes the request and overwrites the administrator credentials, granting the attacker administrative login. This attack is reachable remotely over HTTP(S) and requires no interaction from the victim.

No verified public exploit code is available. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-5523

Indicators of Compromise

Unexpected changes to administrator email addresses or password hashes in the wp_users table
POST requests to Divi Form Builder submission endpoints containing a user_id parameter referencing accounts other than the authenticated caller
New administrator logins from previously unseen IP addresses shortly after subscriber-level form submissions
Password reset notifications delivered to attacker-controlled email addresses

Detection Strategies

Audit WordPress access logs for form submission requests where the submitting session's user ID differs from any user_id field in the POST body
Enable WordPress audit logging plugins to record user profile modifications and correlate them with the initiating session
Compare current user_email and user_pass values against known-good backups to identify unauthorized modifications

Monitoring Recommendations

Alert on any modification to accounts holding the administrator role
Monitor for privilege escalation patterns: subscriber account creation followed by administrator credential changes within a short time window
Track HTTP requests targeting Divi Form Builder AJAX handlers and REST endpoints for anomalous parameter usage

How to Mitigate CVE-2026-5523

Immediate Actions Required

Update the Divi Form Builder plugin to a version later than 5.1.8 once a patched release is available from Divi Engine
Review all administrator accounts for unauthorized email or password changes and force a password reset for all privileged users
Disable open user registration on affected WordPress sites until patching is complete
Audit the wp_users and wp_usermeta tables for anomalies introduced since the plugin was installed

Patch Information

Refer to the Divi Engine Changelog for the fixed release version. Apply the vendor update immediately after verifying integrity in a staging environment.

Workarounds

Deactivate the Divi Form Builder plugin until a patched version is installed
Restrict subscriber-level registration by requiring administrator approval for new accounts
Deploy a Web Application Firewall (WAF) rule that blocks form submissions containing a user_id parameter mismatched with the authenticated session
Remove or disable any Divi Form Builder forms that provide user registration or profile update functionality

bash

# Configuration example: disable open registration in wp-config.php
define( 'DISALLOW_FILE_MODS', true );

# Or via WordPress options table
wp option update users_can_register 0
wp option update default_role subscriber