CVE-2026-4275: Divi Torque Lite CSRF Vulnerability Allows Plugin Installation

Technical summary

The vulnerability stems from improper use of the permission_callback parameter in WordPress REST API route registration. The plugin uses '__return_true' for the /install_plugin and /activate_plugin endpoints, which unconditionally allows REST requests to proceed without nonce validation. Although the endpoint handlers perform current_user_can() capability checks, those checks pass automatically when the request is authenticated via the admin's session cookies. In a CSRF scenario, an attacker's malicious site can trigger HTTP requests from an admin's authenticated browser session, causing those checks to succeed and allowing plugin installation. The root cause is the absence of a nonce—a cryptographically random token tied to the user's session—that WordPress would normally require and validate for state-changing operations.

Business impact

A successful CSRF attack could lead to unauthorized installation of malicious or cryptic plugins that harvest data, inject malware into site content, redirect visitors to phishing sites, or establish persistence for further intrusion. For agencies and businesses relying on WordPress-based sites, this threatens data integrity, customer trust, and regulatory compliance (GDPR, HIPAA, PCI-DSS). The attacker gains a foothold without triggering typical security alerts tied to password-based account compromise, making detection and attribution harder during incident response.

Affected systems

All WordPress installations using the Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin in version 4.2.3 and earlier are vulnerable. The attack requires at least one WordPress administrator to be logged into the site's dashboard when the CSRF request is triggered. The vulnerability does not affect sites that have not installed this plugin or those running patched versions.

Exploitability

Exploitability is moderate to high in real-world environments. An attacker must craft a webpage (or email with embedded content) that, when visited by an authenticated admin, silently submits a request to install a plugin. This can be done using HTML forms with hidden fields or JavaScript. The UI requirement (admin must visit the attacker's page) is typically satisfied via phishing, social engineering, or malicious advertising. No special technical knowledge beyond basic web development is required; no zero-day exploit or authentication bypass is needed. The vulnerability is not currently tracked in the CISA KEV catalog.

Remediation

Update the Divi Torque Lite plugin to a version newer than 4.2.3 that includes proper nonce validation on the vulnerable REST API endpoints. Verify the update in the official WordPress plugin repository or vendor advisory before applying. As an interim measure, restrict REST API access via firewall or web application firewall rules if the plugin cannot be immediately updated, or disable the plugin if it is not essential to site operations.

Patch guidance

Monitor the plugin's update notifications in the WordPress dashboard and apply security patches promptly. Review the vendor's advisory for specific patched version numbers and installation instructions. Test the patch in a staging environment before deploying to production to ensure compatibility with other active plugins and themes. After patching, audit REST API logs to check for any exploitation attempts prior to the update.

Detection guidance

Monitor for unusual REST API requests to /install_plugin and /activate_plugin endpoints, especially those originating from external referrers or triggered by administrators during off-hours. Check plugin installation logs for unexpected or unauthorized plugin additions. Implement WordPress security logging plugins that record REST API activity. Use web application firewall rules to flag and block requests to these endpoints from non-admin IP ranges or with missing nonce tokens. Review browser history of administrator accounts for visits to untrusted websites.

Why prioritize this

This vulnerability merits high priority because it allows an unauthenticated attacker to achieve code execution and persistent site compromise via a simple social engineering vector. The high CVSS score (8.8) reflects the combination of network-based attack surface, no special privileges required, high confidentiality and integrity impact, and potential for lateral movement within WordPress multi-site networks. Although the vulnerability requires user interaction (admin must visit a malicious page), the low technical barrier to exploitation and the broad install base of WordPress make it an attractive target for attackers.

Risk score, explained

The CVSS v3.1 score of 8.8 (HIGH) is assigned based on: Attack Vector = Network (remotely exploitable), Attack Complexity = Low (no special conditions needed), Privileges Required = None (no valid account needed), User Interaction = Required (admin must visit attacker's page), Scope = Unchanged, Confidentiality Impact = High (arbitrary plugin code can read sensitive data), Integrity Impact = High (arbitrary plugin code can modify site content and database), and Availability Impact = High (plugin code can shut down services or render the site inoperable). The score reflects a severe but realistic threat that merits urgent attention.

Frequently asked questions