The Divi Form Builder plugin for WordPress contains a missing authorization flaw that allows an authenticated user to change any other user's email address and password. The flaw arises because the update_user() function accepts a user ID from form submissions without verifying that the requester has permission to edit that account, and the handle_register_submission() function only confirms that any user is logged in rather than checking authorization for the target account. As a result, an attacker who is logged in with a Subscriber role or higher can impersonate administrators and completely take over the site.

All WordPress installations running Divi Engine’s Divi Form Builder plugin version 5.1.8 or earlier are affected. The vulnerability is inherent to the plugin itself; no other plugins or themes are required for exploitation. Any site that has the plugin enabled and any authenticated user with at least Subscriber level can trigger the exploit.

The CVSS score of 8.8 classifies this issue as high severity. The EPSS score of less than 1% indicates a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the user profile update form, which is accessible to any logged‑in user with Subscriber level or higher. An attacker who successfully updates another user’s credentials can achieve full account takeover, compromising all data, operations, and the integrity of the site.