CVE-2026-19652 is a critical privilege escalation vulnerability in the Divi Membership WordPress plugin (versions <= 2.2.0). The `dmem_form_submit_handler()` function improperly manages user roles by iterating over all WordPress roles and verifying an attacker-controlled bcrypt hash supplied in the `form_id` POST parameter without validating or whitelisting allowed roles. An attacker can submit a bcrypt hash of 'administrator' to register a new administrator account. If `auto_login=on` is also submitted, the attacker is immediately authenticated as that administrator, resulting in full site compromise. Although exploitation requires a WordPress nonce, this nonce is publicly available on any page rendering the registration form, allowing unauthenticated attackers to obtain it easily.

Successful exploitation allows an unauthenticated attacker to create a new user account with administrator privileges and immediately authenticate as that administrator, leading to full site takeover. This compromises confidentiality, integrity, and availability of the affected WordPress site.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Divi Membership registration form or disable the plugin if possible to prevent exploitation. Monitor vendor channels for updates and apply any official patches promptly once released.