Privilege Escalation in Divi Membership Plugin for WordPress

CVE-2026-19652

What is CVE-2026-19652?

The Divi Membership plugin for WordPress contains a vulnerability that allows unauthenticated users to escalate their privileges. This issue arises from the dmem_form_submit_handler() function, which determines a new user's role by iterating through all WordPress roles and using an attacker-controlled bcrypt hash provided in the form_id POST parameter. Due to the lack of validation or restriction of allowed roles, an attacker can submit a predetermined bcrypt hash for the administrator role and, by exploiting the auto_login=on parameter, gain instant access as an administrator. Although exploitation requires a WordPress nonce, this nonce is generally exposed on any page displaying the registration form, making it accessible to unauthenticated visitors.

References