By Jeh·October 2, 2026·4 min read·Operator playbook

Divi Membership vulnerability lets anyone become admin

Drafted through my n8n + AI pipeline, edited by me.

A critical flaw in the Divi Membership plugin, publicly disclosed today, lets anyone register as a WordPress administrator with one crafted form submission and no password at all. If this plugin is anywhere on your site, even deactivated, this is today's job.

Divi Membership is a membership and paywall add-on sold separately through DiviEngine for use with the Divi theme and builder. Researchers found that its registration handler checks a submitted role claim against a password hash instead of checking who is actually logged in, which earned the bug a CVSS score of 9.8, the top of the scale. The flaw is tracked as CVE-2026-19652.

What the Divi Membership vulnerability actually does

The plugin's dmem_form_submit_handler() function is supposed to assign a new user the role they registered for. Instead of checking a fixed list of allowed roles, it loops through every role WordPress knows about and runs a password check against a value the attacker controls in the submitted form. Send a bcrypt hash computed locally to match the word administrator, add a flag that turns on auto login, and the plugin hands back a live admin session in one request.

Why unauthenticated is the part that matters

Check this even if you don't remember installing it

Most privilege escalation bugs need a lower level account first, something like a subscriber login that then gets upgraded. This one skips that step entirely. The only thing required is the WordPress nonce that the Divi Membership registration form prints into the page for every visitor, so if that form is live anywhere on your site, the nonce is already public. Because it ships as a separate add-on from DiviEngine rather than through the Divi theme itself, it is easy to forget it is installed at all.

What to do today

1
Check your version
In wp-admin, go to Plugins and find Divi Membership, including in the inactive list. Anything at version 2.2.0 or earlier is exposed.
2
Update to 2.3.0 or later
DiviEngine ships updates through its own licensing system rather than the WordPress.org repository, so check your DiviEngine account or the plugin's own update screen if automatic updates are not already turned on.
3
Audit your administrator accounts
Look for any admin level user you do not recognize, especially one created today or in the last few days with an unfamiliar email or username.
4
Remove and rotate
Delete any account you cannot account for, reset passwords for your real admin accounts, and check for recent file changes if you find evidence someone got in before you patched.

Role claim is checked with password_verify() against an attacker-supplied hash
Any built-in WordPress role can be claimed, including administrator
auto_login=on hands back a live session immediately
Only a public, page-rendered nonce is needed to attempt it

Updating from 2.2.0 to 2.3.0 is the fix: it adds the role whitelist the original form handler never had.

Do I need the main Divi theme for this to affect me?

No. Divi Membership is a separate add-on sold through DiviEngine. The bug is in the plugin's own form handler, not in the Divi theme or builder, so sites running Divi without this add-on are not affected by this specific flaw.

Is this already being actively exploited?

As of today it is not listed in CISA's known exploited vulnerabilities catalog, but the exact exploit mechanics, including the specific POST parameters involved, are already public. That combination has historically led to mass scanning within days, not weeks.

If you are not sure which premium plugins and add-ons are actually sitting on your site, or which ones are still getting updates from their maker, that is worth a short look before the next one of these lands. Happy to help you map out what is actually running.

Building something this should run inside?

Book a call

Keep reading

Stay in the loop

The occasional system worth stealing, automation notes and the odd offer. No spam, unsubscribe anytime.