WordPress Divi Torque Plugin CSRF REST API Bypass

The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress's built-in REST API nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the absence of nonce verification means that a forged cross-site request from a logged-in administrator's browser will pass the capability check via the admin's session cookies. This makes it possible for unauthenticated attackers to install arbitrary plugins from WordPress.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Divi Torque Lite plugin for WordPress contains a critical Cross-Site Request Forgery (CSRF) vulnerability affecting versions up to 4.2.3. The vulnerability stems from improper REST API endpoint protection, where the /install_plugin and /activate_plugin endpoints use '__return_true' as their permission callback, completely bypassing WordPress's nonce verification mechanism. While the endpoints do contain internal current_user_can() checks, the absence of nonce validation at the REST API layer allows attackers to forge requests and trick authenticated users into installing or activating arbitrary plugins. This affects WordPress site administrators and users with plugin management capabilities, potentially leading to unauthorized code execution and full site compromise. Given that Divi is one of WordPress's most popular page builders with millions of active installations, this vulnerability poses a significant threat to a substantial portion of the WordPress ecosystem.

Casky's 322 matching skills detect attack patterns associated with this CSRF vulnerability by analyzing MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance) through Claude's extended reasoning. Practitioners using Casky would identify suspicious REST API calls to vulnerable endpoints, detection of forged cross-origin requests lacking proper nonce tokens, and behavioral patterns indicating unauthorized plugin installation or activation attempts. The platform's skill mapping would surface indicators such as unexpected REST API permission callbacks, missing CSRF tokens in request flows, and anomalous administrator activity that deviates from normal plugin management patterns. Security teams would receive findings highlighting the absence of proper nonce validation mechanisms and the exploitation chain from initial social engineering through malicious plugin activation, enabling them to prioritize patching and implement compensating controls like Web Application Firewalls rules to block suspicious REST API requests.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-4275.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-4275

Casky has 322 skills that investigate the attack patterns behind CVE-2026-4275. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn