CVE-2026-2626 - Vulnerability Analysis

Overview

Divi-Booster WordPress plugin < 5.0.2 contains a PHP Object Injection caused by lack of authorization and CSRF checks combined with unsafe unserialize() usage in a fixing function, letting unauthenticated attackers modify plugin options and potentially execute code.

Severity & Score

Impact

Unauthenticated attackers can modify plugin options and potentially execute arbitrary PHP code, leading to full site compromise.

Mitigation

Update to version 5.0.2 or later.

References

• https://wpscan.com/vulnerability/c8f5e821-1788-419f-a00c-cfd4306d0fa5/

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 11, 2026

🟠 CVE-2026-2626 - High (8.1) The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to modify stored divi-booster WordPress plugin before 5.0.2 options. Furthermore, due to the u... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2626/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner