The Divi Form Builder plugin contains a flaw that permits unauthenticated users to specify an arbitrary role when creating a new account. Because the role field is not validated against the form’s default_user_role, an attacker can submit a role of administrator and have the system create an admin‑level account. This results in full privilege escalation with the ability to modify site settings, manage content, and access sensitive data.

The vulnerability is present in Divi Engine’s Divi Form Builder for WordPress in all releases up to and including version 5.1.2. Systems running this plugin without an updated version are at risk; the risk is limited to environments where the form is enabled and registration is open to the public.

The flaw has a CVSS score of 9.8, indicating a high‑severity critical vulnerability. No EPSS data is available, but the nature of the flaw—a simple, unauthenticated POST to a publicly visible registration endpoint—implies that it could be exploited quickly if an attacker discovers the form. Because the flaw is not listed in the National Vulnerability Databases KEV catalog, there is no advisory evidence of active exploitation yet, yet the high impact warrants urgent attention.