Diviengine Divi Membership vulnerabilities

CVE-2026-19660 [CRITICAL] CWE-287 CVE-2026-19660: The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up t The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter with no IPN validation, no cryptographic signature check, no ownership verification, and no nonce, al

CVE-2026-19652 [CRITICAL] CWE-269 CVE-2026-19652: The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, an The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `password_verify()` against an attacker-controlled bcrypt hash supplied in the `form_id` POST p