CVE-2026-19652

Name of the Vulnerable Software and Affected Versions Divi Membership versions prior to 2.2.1

Description An issue exists in the dmem form submit handler() function that allows unauthenticated attackers to escalate privileges. The function determines a new user's role by iterating through all WordPress roles and calling password verify() against a bcrypt hash provided in the form id POST parameter without validation or a whitelist of allowed roles. By submitting a locally computed bcrypt hash of administrator via the form id parameter and setting auto login=on, an attacker can register an account with administrator privileges and be immediately authenticated, leading to a full site takeover. This process requires a WordPress nonce, which is publicly available on any page that renders the registration form.

Recommendations Update Divi Membership to a version newer than 2.2.0. As a temporary mitigation, restrict access to the registration form to prevent unauthenticated users from obtaining the required nonce.