Is CVE-2026-5523 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5523 being exploited in the wild.

How severe is CVE-2026-5523?

High severity, with a CVSS score of 8.8, published 9 July 2026.

Which products and versions are affected?

Divi Engine Divi Form Builder up to, and including, 5.1.8.

Is there a fix for CVE-2026-5523?

A patch was published on 2026-05-24: Security hardening released in version 5.1.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5523 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5523?

Check whether you run Divi Engine Divi Form Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5523: Divi Engine Divi Form Builder account takeover via missing authorization

CVE-2026-5523 · Severity: high · CVSS 8.8 · Published 2026-07-09

The Divi Form Builder plugin for WordPress, which allows site owners to create custom contact and registration forms, contains a security flaw that allows unauthorized users to take over other accounts. By exploiting this vulnerability, a person with a basic user account can change the email address and password of any other user, including site administrators. This could lead to a total loss of control over the website and exposure of sensitive customer data.

Technologies: Divi Engine Divi Form Builder. Vendors: Divi Engine.

Quick answers

Is CVE-2026-5523 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5523 being exploited in the wild.
How severe is CVE-2026-5523?: High severity, with a CVSS score of 8.8, published 9 July 2026.
Which products and versions are affected?: Divi Engine Divi Form Builder up to, and including, 5.1.8.
Is there a fix for CVE-2026-5523?: A patch was published on 2026-05-24: Security hardening released in version 5.1.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5523 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5523?: Check whether you run Divi Engine Divi Form Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Divi Form Builder plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) and Missing Authorization flaw in versions up to 5.1.8. The root cause is located in the update_user() function, which accepts a user ID parameter from form submissions without verifying if the authenticated user has the necessary permissions to modify that specific account. Additionally, the handle_register_submission() function fails to validate permissions for the target user, only checking if a user is logged in. An authenticated attacker with subscriber-level permissions can exploit these flaws to change the email and password of any user, including administrators. A patch was released in version 5.1.9.

Affected products

Divi Engine Divi Form Builder up to, and including, 5.1.8

Timeline

2026-05-24: patched: Security hardening released in version 5.1.9
2026-07-09: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.