CVE-2026-5118

CRITICAL

Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2026-5118. PoCs published by Yucaerin, Jenderal92, puj790201-lab.

AI-analyzed exploit summary The repository contains a functional exploit for CVE-2026-5118, targeting Divi Form Builder <= 5.1.2. It demonstrates unauthenticated privilege escalation by injecting a 'role=administrator' parameter via the plugin's AJAX handler, leveraging a shared nonce and improper role validation.

Description

The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.

Exploits (4)

github WORKING POC
by Yucaerin · pythonpoc
https://github.com/Yucaerin/CVE-2026-5118

The repository contains a functional exploit for CVE-2026-5118, targeting Divi Form Builder <= 5.1.2. It demonstrates unauthenticated privilege escalation by injecting a 'role=administrator' parameter via the plugin's AJAX handler, leveraging a shared nonce and improper role validation.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Divi Form Builder <= 5.1.2
No auth needed
Prerequisites: Target must have Divi Form Builder <= 5.1.2 installed · AJAX endpoint must be accessible
devstral-2 · analyzed May 22, 2026 Full analysis →
github WORKING POC
by Jenderal92 · pythonpoc
https://github.com/Jenderal92/CVE-2026-5118

This Python 2 script exploits an unauthenticated privilege escalation vulnerability in the Divi WordPress plugin (CVE-2026-5118) by extracting a nonce and submitting a crafted multipart request to register an administrator account.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Divi Form Builder <= 5.1.2
No auth needed
Prerequisites: target running vulnerable Divi Form Builder plugin · access to the registration form to extract nonce
devstral-2 · analyzed May 22, 2026 Full analysis →
github WORKING POC
by puj790201-lab · pythonpoc
https://github.com/puj790201-lab/CVE-2026-5118

This repository contains a functional exploit for CVE-2026-5118, an unauthenticated privilege escalation vulnerability in Divi Form Builder <= 5.1.2. The exploit automates the creation of an administrator account via role injection and includes detection, parameter extraction, and verification steps.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Divi Form Builder <= 5.1.2
No auth needed
Prerequisites: Target running vulnerable Divi Form Builder plugin · Access to the WordPress site
devstral-2 · analyzed May 21, 2026 Full analysis →
github WRITEUP
by zycoder0day · poc
https://github.com/zycoder0day/CVE-2026-5118

This repository provides a detailed technical analysis of CVE-2026-5118, an unauthenticated privilege escalation vulnerability in Divi Form Builder <= 5.1.2. It includes root cause analysis, patch recommendations, and a proof-of-concept attack chain.

Classification
Writeup 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Divi Form Builder <= 5.1.2
No auth needed
Prerequisites: Target running Divi Form Builder <= 5.1.2 · Access to a registration form with the vulnerable 'role' parameter
devstral-2 · analyzed May 21, 2026 Full analysis →

Scores

CVSS v3 9.8
EPSS 0.0004
EPSS Percentile 11.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-269
Status published
Products (1)
Divi Engine/Divi Form Builder < 5.1.2
Published May 21, 2026
Tracked Since May 21, 2026