Detection tooling for CVE-2026-5118, an unauthenticated privilege escalation in Divi Form Builder <= 5.1.2, identifying affected WordPress installations and plugin versions.
Divi Form Builder — Unauthenticated Privilege Escalation
"Security Research" • "Defensive Detection" • "Vulnerability Research"
🔥 Overview
CVE-2026-5118 is an unauthenticated privilege-escalation vulnerability affecting Divi Form Builder versions up to 5.1.2.
The issue involves insufficient validation of user-controlled registration parameters, allowing registration data to influence the requested WordPress user role.
This repository contains research and defensive detection tooling for authorized security testing.
📌 Vulnerability Information
Property| Details CVE| "CVE-2026-5118" Product| Divi Form Builder Affected| "<= 5.1.2" Fixed| "5.1.3" Authentication| Unauthenticated Impact| Privilege Escalation Researcher| SangSenimanWartefak
🎯 Affected Versions
Divi Form Builder
<= 5.1.2 → Potentially Affected 5.1.3+ → Fixed
«Always verify the affected-version range against the current vendor advisory and CVE record.»
🔬 Vulnerability
The vulnerable functionality is related to the plugin's form-registration workflow.
The issue occurs when attacker-controlled registration data is insufficiently restricted before being passed to WordPress user-creation functionality.
┌─────────────────────────┐ │ Registration Request │ └────────────┬────────────┘ │ ▼ ┌─────────────────────────┐ │ User-Controlled Data │ └────────────┬────────────┘ │ ▼ ┌─────────────────────────┐ │ Insufficient Validation │ └────────────┬────────────┘ │ ▼ ┌─────────────────────────┐ │ WordPress User Creation │ └────────────┬────────────┘ │ ▼ Potential Privilege Escalation
---The potential security impact includes unauthorized privilege escalation.
🛡️ Detection
The research tooling focuses on identifying potentially affected installations.
Detection can evaluate:
[+] WordPress reachability [+] Divi Form Builder presence [+] Plugin version [+] Known plugin indicators [+] Vulnerable version range
Detection Flow
Target │ ▼ WordPress Detection │ ▼ Plugin Identification │ ▼ Version Detection │ ▼ Version Assessment │ ├── <= 5.1.2 ──► POTENTIALLY AFFECTED │ └── >= 5.1.3 ──► FIXED
«Detection results should be independently validated before being treated as confirmed findings.»
🚀 Installation
git clone https://github.com/SangSenimanWartefak/CVE-2026-5118.git cd CVE-2026-5118 pip install -r requirements.txt
🧪 Lab Environment
Recommended environment:
WordPress Divi Form Builder <= 5.1.2 PHP Python 3.x Local / Isolated Test Server
For responsible testing, use systems that you own or have explicit permission to assess.
🔧 Mitigation
Administrators should update Divi Form Builder to 5.1.3 or later according to the applicable vendor security guidance.
After remediation, review:
WordPress Users User Roles Authentication Logs Web-Server Access Logs Recently Modified Plugins Recently Modified Themes Unexpected Administrator Accounts
✅ Security Checklist
[ ] Identify installed Divi Form Builder version [ ] Determine affected version status [ ] Upgrade to 5.1.3+ [ ] Review WordPress administrator accounts [ ] Review user-role changes [ ] Review authentication logs [ ] Review web-server logs [ ] Check modified plugins/themes [ ] Re-test after remediation
⚠️ Disclaimer
This repository is intended for:
Only test systems that you own or have explicit permission to assess.
The author is not responsible for unauthorized use, damage, data loss, service disruption, or other consequences resulting from misuse of this research.
👤 Researcher
Security Researcher / Vulnerability Research
📚 References
"SangSenimanWartefak" • "2026"
