# CVE-2026-5118: Divi Engine Divi Form Builder privilege escalation in registration forms

Source: https://junglewise.ai/threats/cve-2026-5118-divi-engine-divi-form-builder-privilege-escalation-in-registration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-5118 · Severity: critical · CVSS 9.8 · Published 2026-05-21

The Divi Form Builder plugin for WordPress, which allows site owners to create custom registration and contact forms, contains a critical security flaw. An unauthenticated attacker can exploit this vulnerability to create a new account with administrative privileges by manipulating the registration process. This allows a complete takeover of the affected WordPress website, potentially leading to data theft, site defacement, or the installation of malicious software.

Technologies: [Divi Engine Divi Form Builder](https://junglewise.ai/threats/technologies/divi-form-builder). Vendors: [Divi Engine](https://junglewise.ai/threats/vendors/divi-engine).

## Quick answers

**Is CVE-2026-5118 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5118 being exploited in the wild.

**How severe is CVE-2026-5118?** Critical severity, with a CVSS score of 9.8, published 21 May 2026.

**Which products and versions are affected?** Divi Engine Divi Form Builder Up to and including 5.1.2.

**Is there a fix for CVE-2026-5118?** A patch was published on 2026-04-13: Fixed in version 5.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5118 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5118?** Check whether you run Divi Engine Divi Form Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Divi Form Builder plugin for WordPress (versions up to 5.1.2) is vulnerable to privilege escalation due to improper validation of user-supplied input during the registration process. Specifically, the plugin accepts a user-controlled 'role' parameter from POST data without verifying it against the form's 'default_user_role' configuration. An unauthenticated remote attacker can exploit this by submitting a registration request with the 'role' parameter set to 'administrator'. This results in the creation of a new user account with full administrative rights. The issue was addressed in version 5.1.3 by ensuring registration forms strictly enforce the role defined in the plugin settings.

## Affected products

- Divi Engine Divi Form Builder Up to and including 5.1.2

## Timeline

- 2026-04-13: patched: Fixed in version 5.1.3
- 2026-05-21: disclosed: Vulnerability published by Wordfence and NVD

## References

- [https://diviengine.com/divi-form-builder-changelog/](https://diviengine.com/divi-form-builder-changelog/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/72154404-f956-4ea2-96ec-166ade87885f?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/72154404-f956-4ea2-96ec-166ade87885f?source=cve)

## Related threats

- [Divi Engine Divi Form Builder account takeover via missing authorization](https://junglewise.ai/threats/cve-2026-5523-divi-engine-divi-form-builder-account-takeover-via-missing)
- [Divi Engine Divi Form Builder arbitrary file upload in do_image_upload](https://junglewise.ai/threats/cve-2026-5524-divi-engine-divi-form-builder-arbitrary-file-upload-in-do-image)