CVE-2026-2626
Published: 11 March 2026
Summary
CVE-2026-2626 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-23 (Session Authenticity).
Deeper analysis
CVE-2026-2626, published on 2026-03-11, affects the divi-booster WordPress plugin in versions before 5.0.2. The vulnerability arises from a fixing function that lacks authorization and CSRF checks, allowing unauthenticated users to modify stored plugin options. Additionally, the function's use of unserialize() on this data enables PHP Object Injection when combined with a PHP gadget chain. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H) and maps to CWE-352 (Cross-Site Request Forgery) and CWE-502 (Deserialization of Untrusted Data).
Unauthenticated attackers can exploit this vulnerability remotely over the network, though it requires high attack complexity and no user interaction. Initial exploitation permits arbitrary modification of divi-booster plugin options, while the deserialization flaw allows escalation to PHP Object Injection, potentially leading to high impacts on confidentiality, integrity, and availability.
The WPScan advisory (https://wpscan.com/vulnerability/c8f5e821-1788-419f-a00c-cfd4306d0fa5/) documents the issue, with mitigation achieved by updating to divi-booster version 5.0.2 or later, which introduces the necessary authorization and CSRF protections.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11095
Vulnerability details
The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to modify stored divi-booster WordPress plugin before 5.0.2 options. Furthermore, due to the use of unserialize() on the…
more
data, this could be further exploited when combined with a PHP gadget chain to achieve PHP Object Injection
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is in a publicly accessible WordPress plugin and permits remote unauthenticated exploitation over the network (no user interaction), directly mapping to T1190. PHP Object Injection via unserialize() further enables server-side impacts but does not match additional specific Enterprise techniques without explicit RCE or post-exploitation details.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations to prevent unauthenticated users from accessing and modifying the plugin's fixing function.
Validates information inputs prior to unserialize() to block malicious data leading to PHP Object Injection.
Protects session authenticity to mitigate CSRF exploitation of the unauthenticated fixing function.