Introduction
A missing server-side validation check in the Divi Form Builder plugin for WordPress lets any unauthenticated visitor register as a full administrator without credentials or prior access. With a CVSS score of 9.8 and trivial exploitation mechanics, this is the kind of flaw that automated scanners and botnets will pick up quickly.
Divi Form Builder is developed by Divi Engine, a well-known maker of plugins for the Divi ecosystem. The plugin adds a Form module to the Divi 5 Visual Builder, so site owners can build registration forms, contact forms, and other data collection workflows directly within the Divi page builder. Divi Engine serves a broad community of WordPress users who rely on the Divi theme framework, which gives this vulnerability a significant blast radius across WordPress.
Technical Information
Root Cause: Missing Role Parameter Validation
The vulnerability, classified under CWE 269 (Improper Privilege Management), is in the user registration handling logic of Divi Form Builder versions up to and including 5.1.2. When a registration form is submitted, the plugin reads a role parameter directly from the incoming POST data. The plugin is supposed to assign the role configured in the form's default_user_role setting. It never checks the submitted role value against that configured default and accepts whatever value the client provides.
This is a textbook case of trusting client-side input for a security-critical decision. The form may render with a hidden or preset role field on the front end, but nothing on the server enforces that the value received matches the value the administrator configured.
Attack Flow
The exploitation path is straightforward:
- An attacker identifies a WordPress site running Divi Form Builder with a user registration form enabled.
- The attacker fills out the registration form normally, or crafts a direct POST request to the form's submission endpoint.
- Before submitting, the attacker intercepts the request using a standard web proxy (such as Burp Suite or browser developer tools) and changes the
roleparameter in the POST body toadministrator. - The server processes the registration request, reads the attacker-supplied
rolevalue, and creates a new WordPress user account with theadministratorrole. - The attacker now has full administrative access to the WordPress installation, including the ability to install plugins, modify themes, access the database, and compromise other user accounts.
No step requires authentication, and neither the site owner nor any other user has to do anything. Attack complexity is low, since the attacker needs only basic familiarity with manipulating HTTP requests.
Severity Breakdown
The CVSS 3.1 metrics break down as follows:
| Metric | Value | Implication |
|---|---|---|
| Base Score | 9.8 (Critical) | Requires immediate remediation |
| Attack Vector | Network (AV:N) | Exploitable remotely over the internet |
| Attack Complexity | Low (AC:L) | Trivial to exploit with standard web interception tools |
| Privileges Required | None (PR:N) | Attackers do not need prior access or accounts |
| User Interaction | None (UI:N) | Can be exploited automatically without victim action |
| Impact (C/I/A) | High across all three | Complete compromise of Confidentiality, Integrity, and Availability |
Because the flaw is reachable over the network, needs no privileges, and needs no user interaction, it is well suited to automated, large-scale exploitation.
Affected Systems and Versions
| Software | Affected Versions | Patched Version |
|---|---|---|
| Divi Form Builder (WordPress plugin) | All versions up to and including 5.1.2 | 5.1.3 |
Any WordPress site running Divi Form Builder version 5.1.2 or earlier with a user registration form enabled is vulnerable. Sites that do not use the plugin's registration form functionality may have reduced exposure, but they should still update.
Mitigation
The vendor fixed the issue in version 5.1.3. Registration forms now always assign the exact role chosen in the form settings, so new accounts cannot receive a higher role than configured. Site administrators should:
- Update immediately to Divi Form Builder version 5.1.3 or newer.
- Audit existing user accounts for any unexpected administrator or elevated-privilege accounts that may have been created before the patch was applied.
- After updating, test the registration forms to confirm that they assign only the configured role.
Threat Intelligence
Wordfence publicly disclosed the vulnerability on May 20, 2026, and the NVD record was published on May 21, 2026. As of this writing, available threat intelligence sources do not indicate active exploitation in the wild. Still, the attack needs no authentication, its complexity is low, and public technical details describe the role parameter manipulation, so automated exploitation is a realistic near-term concern. Security researcher 0xd4rk5id3 of EnvoraSec was credited with discovering the vulnerability and reporting it through coordinated disclosure.
