Is CVE-2026-39725 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39725 being exploited in the wild.

How severe is CVE-2026-39725?

High severity, with a CVSS score of 8.8, published 6 October 2026.

Which products and versions are affected?

Elegant Themes Divi Builder 5.03 and earlier.

Is there a fix for CVE-2026-39725?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-39725 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-39725?

Check whether you run Elegant Themes Divi Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39725: Divi Builder Content Visibility remote code execution

CVE-2026-39725 · Severity: high · CVSS 8.8 · Published 2026-10-06

Divi Builder is a popular page builder plugin for WordPress that allows users to visually design website content. A remote code execution vulnerability in the Content Visibility feature allows attackers with contributor-level access to execute arbitrary code on the affected website. This could lead to full site compromise, data theft, or use of the site for hosting malware.

Vendors: Elegant Themes.

Quick answers

Is CVE-2026-39725 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39725 being exploited in the wild.
How severe is CVE-2026-39725?: High severity, with a CVSS score of 8.8, published 6 October 2026.
Which products and versions are affected?: Elegant Themes Divi Builder 5.03 and earlier.
Is there a fix for CVE-2026-39725?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39725 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-39725?: Check whether you run Elegant Themes Divi Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Content Visibility feature of Divi Builder versions 5.03 and earlier, allowing authenticated contributors to execute arbitrary code. The attack requires contributor-level privileges on the WordPress installation but does not require administrative rights. Successful exploitation grants complete remote code execution on the server.

Affected products

Elegant Themes Divi Builder 5.03 and earlier

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.