DiviEngine Divi Membership Plugin up to 2.3.0 on WordPress process_paypal_callback paypal_param improper authentication

Summaryinfo

A vulnerability was found in DiviEngine Divi Membership Plugin up to 2.3.0. It has been declared as critical. The impacted element is the function process_paypal_callback. Executing a manipulation of the argument paypal_param can lead to improper authentication. This vulnerability is handled as CVE-2026-19660. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in DiviEngine Divi Membership Plugin up to 2.3.0. It has been declared as critical. This vulnerability affects the function process_paypal_callback. The manipulation of the argument paypal_param with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter with no IPN validation, no cryptographic signature check, no ownership verification, and no nonce, allowing it to trust an entirely attacker-controlled user ID value that is passed directly to `wp_set_current_user()` and `wp_set_auth_cookie()`. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying an arbitrary user ID in the `paypal_param` GET parameter, resulting in full site takeover. The vulnerability is further compounded by the fact that the PayPal gateway class is instantiated unconditionally regardless of whether PayPal is enabled or configured, ensuring the vulnerable hook is always registered on every front-end request.

The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-19660 since 08/12/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/02/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-91170). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Vendor

• DiviEngine

Name

• Divi Membership Plugin

Version

• 2.0
• 2.1
• 2.2
• 2.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion