Divi Membership: Unauthenticated privilege escalation to administrator
Summary
The Divi Membership WordPress plugin up to and including version 2.2.0 contains a privilege escalation flaw in its registration handling (CWE-269). An unauthenticated attacker can submit a crafted form_id value to register an account with the administrator role and, when auto_login is enabled, be logged in as that administrator in the same request. The required WordPress nonce is publicly visible on any page that renders the registration form, so the preconditions are easy to meet. This leads to full takeover of the website (CVSS 9.8, Critical).
Affected
- Divi Membership (DiviEngine) versions 0 to and including 2.2.0
Fixed in
- Unknown. No vendor statement confirming a fixed version was found. The vendor changelog does not mention this CVE.
Workaround
- No vendor workaround found.
- Disable the Divi Membership registration form or public user registration until a fixed version is confirmed.
Exploitation
- Public proof of concept: none listed (TheHackerWire); none found in our searches.
- CISA KEV: not listed. No evidence of exploitation in the wild found.
- CISA SSVC: exploitation none, automatable yes.
Our recommendation
- Inventory all WordPress sites with Divi Membership and record the exact version.
- On sites running version 2.2.0 or earlier, disable the registration form or public registration now.
- Ask DiviEngine for written confirmation of the fixed version, and check whether it also covers CVE-2026-19660.
- Review administrator accounts and recent registrations; reset credentials if anything is unexpected.
- If available, consider a WAF virtual patch for the registration endpoint.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- DiviEngine Divi Membership product page diviengine.com
- DiviEngine Divi Membership changelog diviengine.com
- FreshySites security bulletin freshysites.com
- Rapid7 via Vulners vulners.com
- Strix CVE record www.strix.ai
- TheHackerWire vulnerability record www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:26.
Original description (NVD)
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `password_verify()` against an attacker-controlled bcrypt hash supplied in the `form_id` POST parameter, with no validation or whitelist of allowed roles. This makes it possible for unauthenticated attackers to register a new account with the administrator role by submitting a locally computed bcrypt hash of `administrator` as `form_id`, and when `auto_login=on` is submitted, be immediately authenticated as that administrator in the same request, resulting in full site takeover. Exploitation requires a WordPress nonce, but that nonce is publicly emitted on any page rendering the Divi Membership registration form and is therefore obtainable by any unauthenticated visitor.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.