CVE-2026-5118

Name of the Vulnerable Software and Affected Versions Divi Form Builder versions prior to 5.1.3

Description The Divi Form Builder plugin for WordPress allows unauthenticated attackers to create administrator accounts. This occurs because the plugin accepts a user-controlled role parameter from POST data during user registration without validating it against the configured default user role setting, leading to privilege escalation.

Recommendations Update to a version later than 5.1.2.