CVE-2026-19660 — Divi Membership (DiviEngine) ≤2.3.0 paypal_param Authentication Bypass

Overview

CVE-2026-19660 — Divi Membership WordPress plugin (DiviEngine) — unauthenticated authentication bypass → login as any existing user, including administrators (CWE-287, CVSS 3.1 9.8 Critical).

| | | |---|---| | Product | Divi Membership (DiviEngine) | | Affected | ≤ 2.3.0 | | Fixed | > 2.3.0 (upgrade via Divi Engine — confirm latest release on your license) | | Vector | init hook → process_paypal_callback |

The handler accepts a base64-encoded paypal_param GET parameter with no PayPal IPN validation, no signature check, and no ownership/nonce checks. Attacker-controlled payload supplies a user ID passed to wp_set_current_user() and wp_set_auth_cookie(). The PayPal gateway may be instantiated even when PayPal is not configured, so the vulnerable path can be reachable on front-end requests.

PoC page: https://pocbit.org/pocs/cve-2026-19660

GitHub: murrez/CVE-2026-19660

CVE.org: CVE-2026-19660

NVD: CVE-2026-19660

Attack chain (summary)

1. Craft paypal_param (base64) encoding attacker-chosen WordPress user ID (often 1 for admin).
2. GET any front-end URL with ?paypal_param=... (exact encoding per PoC).
3. Session cookies issued → verify /wp-admin/ or export cookies (PoC admin / exploit mode).

Check mode fingerprints Divi Membership (readme / markers) without mutating sessions where possible.

Bundled tool (Python 3.9+)

Download poc.py from this page (mirrored from GitHub).

pip install requests

python poc.py check https://target.example/
python poc.py admin https://target.example/ --user-id 1
python poc.py targets.txt
python poc.py targets.txt admin

Discovery hints (your assets only)

Commercial Divi ecosystem plugin—look for Divi Membership / DiviEngine assets, membership checkout pages, and exposed plugin paths under /wp-content/plugins/.

Remediation

1. Upgrade Divi Membership beyond 2.3.0 per vendor changelog.
2. Audit admin sessions and access logs for suspicious paypal_param query strings.
3. Restrict /wp-admin/ by IP where feasible until patched.

See WordPress plugin vulnerabilities guide.

Legal and ethical use

Authorized security testing only.

References

• Divi Membership documentation
• GitHub PoC — CVE-2026-19660
• PoCbit catalog