Divi Membership: Authentication bypass allows login as any user
Summary
Divi Membership for WordPress up to and including version 2.3.0 contains an authentication bypass in its PayPal callback handling. An unauthenticated attacker can supply an arbitrary user ID in the paypal_param GET parameter and be logged in as any existing WordPress user, including administrators, leading to full site takeover. The vulnerable code runs on every front-end request because the PayPal gateway is always instantiated, regardless of whether PayPal is enabled.
Affected
- Divi Membership all versions up to and including 2.3.0
- Unknown whether a specific later version is fixed
Fixed in
Unknown. No vendor advisory or patched version number was found.
Workaround
- Deactivate and remove the plugin if membership features are not essential
- Restrict access at the edge if the site must stay online (no verified rule set available)
Exploitation
- CISA SSVC: Automatable yes, Technical Impact total, Exploitation none
- Not listed in CISA KEV; no confirmed in-the-wild exploitation reported
- Public PoC status conflicting and unverified; assume exploit code may appear quickly
Our recommendation
- Inventory all WordPress sites with Divi Membership and record their versions
- Deactivate the plugin on sites running 2.3.0 or earlier unless it is essential
- Ask DiviEngine for the patched version and advisory, including for CVE-2026-19652
- Review administrator accounts, recently created admins and active sessions; reset admin passwords and invalidate sessions
- Review logs for front-end requests containing the paypal_param parameter
- Re-check the NVD entry and the Wordfence record for updates
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (2 repositories)
murrez/CVE-2026-19660 · MRdark-ops/CVE-2026-19660-exploit
Research sources
- Wordfence threat intelligence record www.wordfence.com
- DiviEngine Divi Membership changelog diviengine.com
- OpenCVE CVE-2026-19660 app.opencve.io
- TheHackerWire CVE-2026-19660 www.thehackerwire.com
- Freshysites security bulletin CVE-2026-19652 (related) freshysites.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:28.
Original description (NVD)
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter with no IPN validation, no cryptographic signature check, no ownership verification, and no nonce, allowing it to trust an entirely attacker-controlled user ID value that is passed directly to `wp_set_current_user()` and `wp_set_auth_cookie()`. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying an arbitrary user ID in the `paypal_param` GET parameter, resulting in full site takeover. The vulnerability is further compounded by the fact that the PayPal gateway class is instantiated unconditionally regardless of whether PayPal is enabled or configured, ensuring the vulnerable hook is always registered on every front-end request.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.