CVE-2026-5523: Divi Form Builder Account Takeover via Missing Authorization (CVSS 8.8)

Technical summary

CVE-2026-5523 is a privilege escalation vulnerability in Divi Form Builder up to version 5.1.8 stemming from insufficient authorization controls in two form handling functions. The update_user() function processes user ID parameters directly from form submissions without verifying the authenticated user's permission to modify the target account. Additionally, handle_register_submission() performs only a generic authentication check (whether any user is logged in) rather than validating authorization against the specific user being modified. An authenticated attacker at subscriber level or above can exploit this to invoke unauthorized account modifications, including email and password changes, leading to complete account compromise.

Business impact

Complete compromise of WordPress administrator accounts represents a critical business risk. An attacker gaining administrative access can install backdoors, exfiltrate data, modify content, inject malicious code into the website, send phishing emails from a trusted domain, or disable security controls. For organizations using Divi to power customer-facing sites, ecommerce platforms, or content management systems, this vulnerability could result in data breaches, website defacement, loss of customer trust, and operational downtime. The ability to modify any account—not just low-privilege ones—means even small WordPress sites with subscriber-level registrations become attack vectors for targeting their administrators.

Affected systems

Any WordPress installation using the Divi Form Builder plugin in versions 5.1.8 and earlier is affected. Risk is highest on sites that permit subscriber registration or have multiple user accounts with varying privilege levels. Sites with form-based user registration or account management features are primary targets. The vulnerability does not require the attacker to have site administrator privileges—subscriber-level access is sufficient, making publicly registered accounts a viable attack vector.

Exploitability

Exploitation requires only subscriber-level access and the ability to submit a form on the affected WordPress site. No special tools or complex techniques are needed; standard HTTP requests can invoke the vulnerable functions. The attack is trivial to execute once an attacker registers a subscriber account. However, not all Divi installations may expose the vulnerable form handling endpoints if they do not use the specific form builder features that trigger update_user() or handle_register_submission(). The lack of CVSS user interaction requirement (UI:N) reflects that the attacker themselves can initiate the action.

Remediation

Update Divi Form Builder to a patched version released after July 9, 2026 that implements proper authorization checks. Verify against the vendor advisory for the specific version number. As an interim measure, disable subscriber registration on the WordPress site if it is not required, or restrict form submissions to administrators only through plugin configuration or custom code. Implement additional permission validation in any custom forms that interact with user data.

Patch guidance

Check the official Divi or Elegant Themes security advisory for the patched version number and apply it immediately if you are running version 5.1.8 or earlier. Before updating, back up your WordPress database and test the patch in a staging environment to ensure compatibility with your theme and other plugins. If a patch is not yet available at the time of discovery, consider temporarily disabling the form builder or restricting access to trusted users only.

Detection guidance

Monitor WordPress user modification logs and audit trails for unexpected changes to user email addresses or password resets, particularly affecting high-privilege accounts. If your WordPress installation logs user creation and modification events, look for submissions originating from low-privilege user accounts that result in changes to administrative accounts. Check user account activity for password changes not initiated through the normal admin interface. Review form submission logs if the plugin records them. Consider enabling WordPress debug logging to capture potential exploitation attempts.

Why prioritize this

This vulnerability merits immediate attention despite not being on the CISA KEV list. It enables complete account takeover of administrators through a simple authenticated exploit, making it a gateway to full site compromise. The low barrier to exploitation—requiring only subscriber access, which attackers can self-register—combined with the high impact (full admin compromise) justifies priority patching. Any organization running Divi with user registration enabled should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects high impact (Confidentiality, Integrity, and Availability all set to High) coupled with low attack complexity and only low privilege requirements. Although the attack requires authentication, subscriber-level access is widely available on WordPress sites that permit public registration. The score appropriately captures that an attacker with minimal legitimate access can escalate to full system compromise through account takeover.

Frequently asked questions