CVE-2026-2626

Description

The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to modify stored divi-booster WordPress plugin before 5.0.2 options. Furthermore, due to the use of unserialize() on the data, this could be further exploited when combined with a PHP gadget chain to achieve PHP Object Injection

PUBLISHED Reserved 2026-02-17 | Published 2026-03-11 | Updated 2026-03-11 | Assigner WPScan

Problem types

CWE-502 Deserialization of Untrusted Data

CWE-352 Cross-Site Request Forgery (CSRF)

Product status

Credits

Saif (Team 51) finder

WPScan coordinator

References

wpscan.com/...rability/c8f5e821-1788-419f-a00c-cfd4306d0fa5/ exploit vdb-entry technical-description

cve.org (CVE-2026-2626)

nvd.nist.gov (CVE-2026-2626)

Download JSON