Divi Form Builder Privilege Escalation via Role Parameter

The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.

Casky was already ahead

This CVE exploits attack patterns that Casky's 203matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Divi Form Builder plugin for WordPress (versions ≤5.1.2) contains a critical privilege escalation vulnerability that allows unauthenticated attackers to create administrator accounts. The vulnerability stems from insufficient input validation on the 'role' parameter during user registration—the plugin accepts user-controlled role data from POST requests without verifying it matches the form's configured default_user_role setting. This means attackers can bypass intended access controls by simply manipulating the role parameter to 'administrator' during account creation. With a CVSS score of 9.8, this vulnerability affects any WordPress installation using the vulnerable Divi Form Builder versions, potentially exposing thousands of sites to complete account takeover and administrative compromise.

Casky's 203 mapped skills detect the attack patterns behind this privilege escalation through Claude AI's extended reasoning across MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would identify suspicious POST requests during user registration that contain role parameters mismatched against the form's configured defaults—a telltale sign of CWE-269 (Improper Access Control). The platform's skills map reconnaissance patterns like reconnaissance of form parameters, account creation with elevated privileges, and lateral comparison of role assignments across registration attempts. Security teams would see findings highlighting unauthenticated requests successfully creating admin accounts, anomalous role elevation attempts, and registration events where submitted role data bypasses server-side validation—enabling rapid threat detection and response before attackers establish persistent administrative access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

203 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5118.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-office365-audit-logs-for-compromise

cloud security · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-5118

Casky has 203 skills that investigate the attack patterns behind CVE-2026-5118. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn