Skip to content
Threat Feed
Subscribe
medium advisory

Divi Form Builder Missing Authorization Vulnerability (CVE-2026-5523) Leads to Account Takeover

The Divi Form Builder plugin for WordPress versions up to 5.1.8 is vulnerable to Missing Authorization, allowing authenticated attackers with subscriber-level access to change the email and password of any user, including administrators, by exploiting improper authorization checks in the update_user() and handle_register_submission() functions, enabling complete account takeover.

The Divi Form Builder plugin for WordPress, in versions up to and including 5.1.8, contains a critical Missing Authorization vulnerability, tracked as CVE-2026-5523. This flaw stems from the update_user() and handle_register_submission() functions, which fail to adequately verify user permissions when processing form submissions. Specifically, update_user() accepts a user ID parameter without confirming the authenticated user's authority to modify that account, while handle_register_submission() merely checks for any logged-in user instead of validating specific target user permissions. This allows authenticated attackers with even subscriber-level access to manipulate user accounts. Exploitation can lead to changing the email address and password of any user, including administrators, culminating in complete account takeover. This vulnerability is significant for WordPress site defenders using the affected plugin.

Attack Chain

  1. An authenticated attacker, possessing subscriber-level credentials, logs into the vulnerable WordPress site running the Divi Form Builder plugin.
  2. The attacker crafts a malicious HTTP POST request targeting a Divi Form Builder endpoint that leverages the update_user() or handle_register_submission() functions.
  3. Within the crafted request, the attacker includes a user ID parameter corresponding to a target user (e.g., an administrator account) and new values for the user_email and user_pass fields.
  4. The Divi Form Builder plugin, specifically versions up to 5.1.8, processes this request without performing sufficient authorization checks on the supplied user ID.
  5. Due to the missing authorization, the plugin proceeds to update the email address and password of the targeted user account in the WordPress database.
  6. The attacker then uses the newly set credentials to successfully log in to the compromised account, achieving full account takeover.
  7. If an administrator account was targeted, the attacker now possesses complete administrative control over the WordPress site.

Impact

Successful exploitation of CVE-2026-5523 grants authenticated attackers, even those with low-privilege subscriber accounts, the ability to take over any user account on the affected WordPress site. This includes administrator accounts, leading to a complete compromise of the website. An attacker with administrative control can deface the site, inject malicious code, steal sensitive data, install backdoors, or use the site for further attacks. The CVSS v3.1 Base Score for this vulnerability is 8.8, indicating high severity and potential for widespread damage.

Recommendation

  • Immediately patch CVE-2026-5523 by updating the Divi Form Builder plugin for WordPress to version 5.1.9 or higher.
  • Review all user accounts for any unauthorized changes to email addresses or passwords since the plugin was installed.
  • Implement strong password policies and multi-factor authentication (MFA) for all WordPress user accounts, especially administrators.
  • Consider deploying a Web Application Firewall (WAF) to potentially filter requests attempting to exploit known vulnerabilities like CVE-2026-5523.