Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter
critical
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter with no IPN validation, no cryptographic signature check, no ownership v...
- CVSS:
- 9.8
(Wordfence)
- Affected:
- up to 2.3.0
- Fixed in:
- 3.0.0
- Disclosed:
- Oct 1, 2026
CVE-2026-19660 on NVD →
Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter
critical
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `password_verify()` against an attacker-controlled bcrypt hash sup...
- CVSS:
- 9.8
(Wordfence)
- Affected:
- up to 2.2.0
- Fixed in:
- 2.3.0
- Disclosed:
- Oct 1, 2026
CVE-2026-19652 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database