CVE-2026-5523 is an authorization bypass vulnerability in Divi Engine's Divi Form Builder plugin for WordPress versions up to and including 5.1.8. The vulnerability arises because the update_user() function accepts a user ID from form submissions without verifying that the authenticated user has permission to edit that user account. Additionally, the handle_register_submission() function only checks if a user is logged in but does not validate permissions for the targeted user. This flaw allows authenticated attackers with subscriber-level privileges or higher to change the email and password of any user, including administrators, leading to full account takeover.

An attacker with at least subscriber-level access can change the email address and password of any user account, including administrators. This results in complete account takeover, compromising confidentiality, integrity, and availability of affected user accounts and potentially the entire WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious account changes. Avoid granting unnecessary privileges to users. Follow vendor updates closely for an official patch or workaround.