The Divi Form Builder plugin for WordPress suffers from improper privilege management (CWE-269) due to lack of validation of the 'role' parameter during user registration. Specifically, the plugin does not verify that the role assigned to a new user matches the form's default_user_role setting, enabling attackers to escalate privileges by creating administrator accounts without authentication. This vulnerability affects all versions up to and including 5.1.2 and has a CVSS 3.1 base score of 9.8, indicating critical severity.

Successful exploitation allows unauthenticated attackers to create administrator accounts on affected WordPress sites using the vulnerable Divi Form Builder plugin. This grants full control over the site, including the ability to modify content, install malicious code, and compromise site integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the registration form or disable the Divi Form Builder registration feature if possible. Monitor for updates from Divi Engine and apply patches promptly once available.