CVE-2026-5118: Divi Form Builder

Overview

CVE-2026-5118 is a privilege escalation weakness in the Divi Form Builder plugin for WordPress. The plugin reportedly trusts a user-supplied 'role' value during user registration instead of enforcing the role configured for the form. The weakness is classified as CWE-269, Improper Privilege Management. Wordfence is the CNA for this record.

Impact

• The record describes a path for unauthenticated users to create accounts with administrator privileges.
• The CVSS 3.1 vector reported is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8 (critical). The vector indicates high confidentiality, integrity and availability impact over the network without privileges or user interaction.
• Administrator access in WordPress generally allows control over site content, plugins, users and configuration. Scope of impact on any particular site depends on that site's configuration.

Affected products and versions

• Product: Divi Engine Divi Form Builder.
• Versions: up to and including 5.1.2.
• No fixed version is listed in the record. The absence of a listed fix does not confirm that no fix exists; administrators should consult the vendor changelog and the Wordfence advisory.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed by that source. No confirmed exploitation appears in the sources consulted. The SSVC record marks exploitation as none and automatable as yes, and the EPSS probability is 0.00528. These indicators describe estimated risk and do not confirm exploitation.

Remediation and mitigation

• Identify all sites running Divi Form Builder and check the installed version against the affected range.
• Review the vendor changelog and the Wordfence advisory for an updated release and apply it as soon as it is available and verified.
• Until a fixed version is confirmed, consider temporarily disabling public registration forms that use the Divi Form Builder, and restrict account creation where operationally feasible.
• Audit existing WordPress user accounts for unexpected administrator roles.

Detection guidance

• Review recently created user accounts, especially those with administrator roles that were not created by staff.
• Check registration logs and web server logs for registration requests to Divi form endpoints with unusual role values.
• Monitor for new administrator accounts and unexpected changes to user roles.

Limitations of the available information

• The record does not include a confirmed fixed version.
• The exact request format and the configuration conditions required to trigger the weakness are not described in the record and are not reproduced here.
• The record lists the source status as Deferred, and the reference set is limited to the Wordfence advisory, the vendor changelog and NVD/CVE pages.
• Whether a given site is exposed depends on whether public registration using the plugin is enabled, which the record does not describe.

Frequently asked questions

What is CVE-2026-5118?

It is a privilege escalation weakness in Divi Form Builder for WordPress, up to and including version 5.1.2, where the registration role value is not validated against the form setting.

Is this vulnerability being actively exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

Is a fixed version available?

The record does not list a fixed version. Check the vendor changelog and the Wordfence advisory for updates.

What should site owners do now?

Check whether the plugin is installed, review administrator accounts, consider limiting public registration, and apply a vendor update once it is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.