CVE-2026-5118criticalCWE-269

CVE-2026-5118: critical vulnerability in Divi Form Builder

Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'

Published

Follow this CVE+ Monitor Divi Form Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 0.5%
from disclosure to weaponsame day
Published on NVDMay 21
1st PoCMay 21
The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Divi Engine · Divi Form Builder
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Divi Form Builder

In the same product, most dangerous first.

CVE-2026-5524CRITICALDivi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' ParameterEPSS 3.5%CVE-2026-5523HIGHDivi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update FormEPSS 0.4%