CVE-2026-19652 DiviEngine CVE debrief

Who should care

WordPress administrators and users of the Divi Membership plugin should assess their exposure and take immediate action to prevent exploitation. This includes updating the plugin to a version that fixes the vulnerability, restricting access to the registration form, and monitoring for suspicious activity. Additionally, security teams should review compensating controls and verify patch deployment to prevent potential site takeover and elevation of

Why it matters

CVE-2026-19652 is a critical Privilege Escalation vulnerability in the Divi Membership plugin for WordPress. Unauthenticated attackers can exploit this vulnerability to register as administrators, leading to full site takeover. WordPress administrators and users of the Divi Membership plugin must assess their exposure and take immediate action to prevent exploitation.

• Immediate site takeover by unauthenticated attackers
• Elevation of privileges for arbitrary users
• Potential for lateral movement within the compromised site
• Verification of patch deployment and user role configurations

Technical summary

The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. The `dmem_form_submit_handler()` function determines the new user's role by iterating all WordPress roles and calling `password_verify()` against an attacker-controlled bcrypt hash supplied in the form_id POST parameter, with no validation or whitelist of allowed roles. This vulnerability allows unauthenticated attackers to register a new account with administrator privileges by submitting a locally computed bcrypt hash of 'administrator' as the form_id parameter. Exploitation requires a WordPress nonce, which is publicly emitted on any page rendering the Divi Membership registration form. The

Defensive priority

High

Recommended defensive actions

• Immediately update the Divi Membership plugin to a version that fixes the Privilege Escalation vulnerability.
• Restrict access to the Divi Membership registration form to prevent unauthenticated access.
• Monitor for suspicious registration attempts and changes to user roles.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability allows unauthenticated attackers to register a new account with administrator privileges by submitting a locally computed bcrypt hash of 'administrator' as the form_id parameter. Exploitation requires a WordPress nonce, which is publicly emitted on any page rendering the Divi Membership registration form.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.