CVE-2026-5118
published 2026-05-21CVE-2026-5118: The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a…
PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.49%
38.3th percentile
The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| divi_engine | divi_form_builder | <= 5.1.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Divi Engine Divi Form Builder Plugin up to 5.1.2 on WordPress Setting default_user_role privileges management (EUVD-2026-31270)
vuldb·2026-05-21·CVSS 9.8
CVE-2026-5118 [CRITICAL] Divi Engine Divi Form Builder Plugin up to 5.1.2 on WordPress Setting default_user_role privileges management (EUVD-2026-31270)
A vulnerability was found in Divi Engine Divi Form Builder Plugin up to 5.1.2 on WordPress. It has been classified as critical. Affected by this vulnerability is the function default_user_role of the component Setting Handler. Performing a manipulation of the argument role results in improper privilege management.
This vulnerability was named CVE-2026-5118. The attack may be initiated remotely. There is no available exploit.
GHSA
GHSA-75vq-ppvv-frh3: The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5
ghsa_unreviewed·2026-05-21
CVE-2026-5118 [CRITICAL] CWE-269 GHSA-75vq-ppvv-frh3: The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5
The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-21
Published