Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'

Wordfence Intelligence > Vulnerability Database > Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'

9.8

Improper Privilege Management

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE	CVE-2026-5118
CVSS	9.8 (Critical)
Publicly Published	May 20, 2026
Last Updated	May 21, 2026
Researcher	0xd4rk5id3 - EnvoraSec

Description

The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.

References

diviengine.com

Vulnerability Details for Divi Form Builder

Divi Form Builder

Software Type	Plugin
Software Slug	divi-form-builder
Patched?	Yes
Remediation	Update to version 5.1.3, or a newer patched version
Affected Version	<= 5.1.2
Patched Version	5.1.3

Recent vulnerabilities in Divi Form Builder

Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form

8.8

CVE-2026-5523

Jul 8, 2026

Researcher: 0xd4rk5id3

Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter

9.8

CVE-2026-5524

Jul 1, 2026

Researcher: 0xd4rk5id3

#	Title	CVE ID	CVSS	Researchers	Date
1	Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form	CVE-2026-5523	8.8	0xd4rk5id3	July 8, 2026
2	Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter	CVE-2026-5524	9.8	0xd4rk5id3	July 1, 2026

View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Have information to add, or spot any errors? Contact us at wfi-support@wordfence.com so we can make any appropriate adjustments.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation