Executive brief
The Divi Form Builder plugin for WordPress, which allows site owners to create custom registration and contact forms, contains a critical security flaw. An unauthenticated attacker can exploit this vulnerability to create a new account with administrative privileges by manipulating the registration process. This allows a complete takeover of the affected WordPress website, potentially leading to data theft, site defacement, or the installation of malicious software.
Technical details
The Divi Form Builder plugin for WordPress (versions up to 5.1.2) is vulnerable to privilege escalation due to improper validation of user-supplied input during the registration process. Specifically, the plugin accepts a user-controlled 'role' parameter from POST data without verifying it against the form's 'default_user_role' configuration. An unauthenticated remote attacker can exploit this by submitting a registration request with the 'role' parameter set to 'administrator'. This results in the creation of a new user account with full administrative rights. The issue was addressed in version 5.1.3 by ensuring registration forms strictly enforce the role defined in the plugin settings.
Affected products
- Divi Engine Divi Form Builder Up to and including 5.1.2
Timeline
- 2026-04-13: patched: Fixed in version 5.1.3
- 2026-05-21: disclosed: Vulnerability published by Wordfence and NVD