CVE-2026-5118

The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.

• CWE-269

• https://diviengine.com/divi-form-builder-changelog/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/72154404-f956-4ea2-96ec-166ade87885f?source=cve

Published

May 21, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5112The Gravity Forms plugin for WordPress is vulnerable to Unau…7.2
• CVE-2026-5113The Gravity Forms plugin for WordPress is vulnerable to Stor…7.2
• CVE-2026-5114The SpeedyCache plugin for WordPress is vulnerable to Arbitr…4.9
• CVE-2026-51144Cross Site Scripting vulnerability in Soliton Systems MailZe…6.1
• CVE-2026-5115The PaperCut NG/MF (specifically, the embedded application f…7.5
• CVE-2026-5116The Contact Form 7 – Dynamic Text Extension plugin for WordP…4.4
• CVE-2026-5119A flaw was found in libsoup. When establishing HTTPS tunnels…8.2
• CVE-2026-51190The "s init" command in Serverless-Devs @serverless-devs/s <…9.8
• CVE-2026-5120A Race Condition vulnerability affecting BIOVIA Workbook fro…8.1
• CVE-2026-5121A flaw was found in libarchive. On 32-bit systems, an intege…7.5
• CVE-2026-51218A heap buffer overflow in the TS7Worker::PerformFunctionWrit…7.5
• CVE-2026-51219A heap buffer overflow in the HighPriorityASDUQueue_hasUncon…7.5