Skip to content
OpenAdvisories

Vendor

DiviEngine

2 known vulnerabilities.

Products

Divi Membership 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-19652

    Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter

    The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `pass…

    DiviEngine Divi Membership Web / CMS
  • Critical 9.8
    CVE-2026-19660 Public exploit

    Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

    The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter with no IPN…

    DiviEngine Divi Membership Web / CMS