PT-2026-42460 · WordPress · Divi Form Builder

Jude Nwadinobi · Published 2026-05-21 · Updated 2026-05-23 · CVE-2026-5118

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Divi Form Builder versions prior to 5.1.3

Description The Divi Form Builder plugin for WordPress allows unauthenticated attackers to create administrator accounts. This occurs because the plugin accepts a user-controlled role parameter from POST data during user registration without validating it against the configured default user role setting, leading to privilege escalation.

Recommendations Update to a version later than 5.1.2.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-5118

Affected Products

Divi Form Builder

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-5118 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/72154404-f956-4ea2-96ec-166ade87885f?source=cve · Note
• https://twitter.com/ThreatAft/status/2058033971397832851 · Twitter Post
• https://t.me/CVEtracker/54506 · Telegram Post
• https://diviengine.com/divi-form-builder-changelog · Note
• https://twitter.com/OrizonCyber/status/2057453896667201919 · Twitter Post