important · Privilege
Two Divi Membership request paths let an unauthenticated visitor become or impersonate a WordPress administrator.
Affects
Divi Membership by Divi Engine, a membership and registration plugin for WordPress websites.
One registration handler trusts serialized form metadata that selects the Administrator role.
Detail and 5 sources
A separate PayPal callback accepts an unsigned encoded user ID and sets that user's authentication cookie.
Published records identify corrected releases for both paths.
Sources
ResearchCVE-2026-19652: Divi Membership - CVE.reportResearchCVE-2026-19660: Divi Membership - CVE.reportResearchPrivilege Escalation in WordPress Divi Membership Plugin - PatchstackResearchPrivilege Escalation in WordPress Divi Membership Plugin - PatchstackResearchDivi Membership Changelog - Divi Engine