CVE-2026-19660 in Divi Membership Plugin
Summary
by MITRE • 10/02/2026
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter with no IPN validation, no cryptographic signature check, no ownership verification, and no nonce, allowing it to trust an entirely attacker-controlled user ID value that is passed directly to `wp_set_current_user()` and `wp_set_auth_cookie()`. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying an arbitrary user ID in the `paypal_param` GET parameter, resulting in full site takeover. The vulnerability is further compounded by the fact that the PayPal gateway class is instantiated unconditionally regardless of whether PayPal is enabled or configured, ensuring the vulnerable hook is always registered on every front-end request.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The Divi Membership plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to and including 2.3.0. This flaw resides within the `process_paypal_callback` function, which is hooked into the WordPress initialization action. The core technical issue stems from the function's handling of incoming HTTP requests via a base64-encoded GET parameter named `paypal_param`. Instead of performing standard Internet Payment Notification (IPN) validation or verifying cryptographic signatures to ensure the request originates legitimately from PayPal, the plugin blindly trusts this input. There is no nonce verification, no ownership check against the authenticated session context, and no IP restriction logic in place during this specific callback processing phase. This lack of integrity checks allows an attacker to craft a malicious URL containing arbitrary data within the `paypal_param` field that bypasses all security boundaries intended for payment callbacks.
The operational impact of this vulnerability is severe because it enables unauthenticated attackers to assume the identity of any existing user on the WordPress installation, including those with administrator privileges. The vulnerable code path takes the attacker-controlled value from the `paypal_param` parameter and passes it directly into two critical WordPress functions: `wp_set_current_user()` and `wp_set_auth_cookie()`. By injecting a specific numeric or string-based User ID into this flow, an attacker can force the system to create a valid authentication session for that target user. This effectively grants full control over the targeted account without requiring any prior knowledge of passwords or multi-factor authentication tokens. Once authenticated as an administrator, the attacker gains complete access to the site's backend, database, and configuration files, leading to a total compromise of the web application and potentially the underlying server infrastructure if further exploitation steps are taken.
The severity of this vulnerability is significantly amplified by how the PayPal gateway class is instantiated within the plugin architecture. The vulnerable code path is registered unconditionally on every front-end request, regardless of whether the PayPal payment gateway has been enabled or configured in the WordPress admin settings. This design decision ensures that the attack surface remains consistently exposed to all visitors and automated scanners at all times. Attackers do not need to discover specific configuration states or wait for a user to initiate a legitimate transaction; they can simply send crafted HTTP requests directly to the plugin's callback endpoint from any location on the internet. The absence of conditional checks means that even if PayPal is disabled, the code responsible for processing these callbacks remains active and vulnerable, providing a persistent entry point for exploitation.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to properly verify the identity of users attempting to gain access. It also relates closely to CWE-345 Insufficient Verification of Data Authenticity, given that the application accepts and processes data from an external source without validating its origin or integrity. In terms of offensive security frameworks such as MITRE ATT&CK, this exploit maps directly to T1078 Valid Accounts, where attackers leverage legitimate credentials or identities to maintain access. The specific technique involves manipulating input parameters to bypass authentication mechanisms, which falls under the broader category of Authentication Bypass using Manipulated Inputs. This type of flaw is particularly dangerous in e-commerce and membership plugins because it undermines the fundamental trust model that separates public-facing payment processing from private user account management.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade the Divi Membership plugin to a version where this vulnerability has been patched by the vendor, ensuring that proper IPN validation and signature verification are implemented for all callback handlers. If an update is not immediately available, administrators should consider disabling PayPal integration entirely if it is not in use, although given the unconditional instantiation of the gateway class, complete deactivation may require manual code intervention or plugin removal until a patch is released. Security hardening measures such as implementing strict input validation and ensuring that callback functions verify the source IP against known PayPal ranges can provide additional layers of defense. Furthermore, developers should adhere to secure coding standards by never trusting user-supplied data in authentication contexts without rigorous verification mechanisms, including nonces for state-changing operations and cryptographic signatures for external API callbacks. Regular security audits and penetration testing focused on payment processing endpoints are recommended to identify similar flaws before they can be exploited in production environments.