CVE-2026-4275

Name of the Vulnerable Software and Affected Versions Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme versions prior to 4.2.4

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a logged-in user into performing actions they did not intend. This occurs because the /install plugin and /activate plugin REST API endpoints use return true as the permission callback, which bypasses the standard nonce verification (a unique token used to prevent CSRF) in the WordPress REST API. While internal current user can() checks are present, the lack of nonce verification allows a forged request from an administrator's browser to pass these checks using the administrator's session cookies, enabling unauthenticated attackers to install arbitrary plugins.

Recommendations Update to a version newer than 4.2.3. Restrict access to the /install plugin and /activate plugin REST API endpoints as a temporary mitigation measure.