The Divi Membership plugin misinterprets an attacker‑controlled bcrypt hash submitted via the form_id field as a user role, iterating through all WordPress roles and calling password_verify. If the hash matches a role, the plugin assigns that role to the newly created account. By providing a locally computed hash for the administrator role and setting auto_login=on, an unauthenticated visitor can register and immediately authenticate as a site administrator in a single request. The vulnerability relies on WordPress nonces that are publicly generated on any page containing the registration form, enabling any unauthenticated visitor to obtain the required nonce.

WordPress sites running Divi Membership plugin version 2.2.0 or earlier are affected. The flaw exists in the plugin’s registration form handling and is present on all public registration pages.

The CVSS score of 9.8 marks this as critical. Although EPSS data is unavailable, the attack requires only a crafted POST request, a publicly discoverable nonce, and no additional privileges, making exploitation straightforward. The vulnerability is not currently listed in the CISA KEV catalog, but the low technical barrier suggests a high likelihood of misuse if unpatched.