CVE-2026-2626: 
WordPress vulnerability analysis and mitigation

CVE-2026-2626 is an unauthenticated PHP Object Injection vulnerability in the Divi Booster WordPress plugin affecting all versions before 5.0.2. The plugin fails to enforce authorization and CSRF checks in one of its fixing functions, allowing unauthenticated users to modify stored plugin options; the use of unserialize() on attacker-controlled data further enables PHP Object Injection when a suitable gadget chain is present. It was publicly disclosed on February 18, 2026, with the CVE record received from WPScan on March 11, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (WPScan, Feedly).

The root causes are missing authorization and CSRF validation (CWE-352) combined with unsafe deserialization of untrusted data (CWE-502). One of the plugin's "fixing" functions accepts a file upload via an unauthenticated HTTP POST request, decompresses the payload with gzdecode, and passes the result directly to PHP's unserialize(), storing the result in the wtfdivi WordPress option. An attacker can craft a serialized PHP object and deliver it as a gzip-compressed file upload without any authentication token or nonce. If a PHP class with a magic method (e.g., __wakeup) is available in the WordPress environment — via the Divi theme or any installed plugin — the deserialization step triggers that method, enabling arbitrary code execution. A prerequisite is that the Divi theme must be active and the plugin settings must have been saved at least once to activate the vulnerable fix routine (WPScan).

Successful exploitation allows an unauthenticated attacker to overwrite the wtfdivi WordPress option with arbitrary data, potentially corrupting site configuration. When a suitable PHP gadget chain exists in the environment (e.g., from the Divi theme or co-installed plugins), the attacker can escalate to remote code execution, achieving full server compromise with the privileges of the web server process. This could result in complete confidentiality, integrity, and availability loss — including theft of sensitive data (credentials, customer records), defacement, malware installation, or use of the server as a pivot point for further attacks (WPScan, Feedly).

No public proof-of-concept exploit code has been released and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.013% (0.000130), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and no user interaction, lowering the barrier for exploitation once a gadget chain is identified in a target environment.

1. Reconnaissance: Identify WordPress sites running the Divi Booster plugin (versions < 5.0.2) with the Divi theme active, using tools like WPScan (wpscan --url https://example.com --enumerate p) or passive fingerprinting via HTTP response headers and page source.
2. Verify precondition: Confirm that the plugin's fixing function is active by checking whether the wtfdivi option exists in the database (indirectly, by observing plugin behavior). The settings page (/wp-admin/admin.php?page=wtfdivi_settings) must have been saved at least once.
3. Create a benign test payload: Generate a gzip-compressed serialized PHP array to confirm the option-write primitive: php -r '$p=["poc"=>"owned"]; echo gzencode(serialize($p));' > poc.conf
4. Send unauthenticated POST request: Upload the payload file without any authentication: curl -i -X POST https://example.com -F "uploaded_file=@poc.conf;type=application/octet-stream"
5. Verify option modification: Confirm the wtfdivi option was overwritten (e.g., via observable site behavior or, if database access is available, SELECT option_value FROM wp_options WHERE option_name = 'wtfdivi';).
6. Identify a PHP gadget chain: Enumerate classes with exploitable magic methods (__wakeup, __destruct, etc.) available in the Divi theme or installed plugins.
7. Craft malicious object payload: Serialize a gadget chain object and gzip-compress it: php -r 'echo gzencode("O:4:\"Evil\":0:{}");' > poc.conf
8. Trigger PHP Object Injection: Upload the malicious payload using the same unauthenticated POST request, causing unserialize() to instantiate the gadget object and execute arbitrary code upon deserialization (WPScan).

• Network: Unauthenticated HTTP POST requests to the WordPress site root or plugin-specific endpoints containing multipart form-data with a file field named uploaded_file and Content-Type: application/octet-stream; absence of authentication cookies or nonce values in such requests.
• Logs: Web server access logs showing POST requests from unexpected IPs with no session cookies; WordPress debug logs recording unserialize() errors or unexpected class instantiation events.
• Database: Unexpected or corrupted value in the wp_options table for option_name = 'wtfdivi'; serialized PHP object strings (beginning with O:) stored in plugin options.
• File System: New or modified files in the WordPress installation directory (web shells, backdoors) created by the web server process user; unexpected .php files in upload directories.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., bash, curl, wget, python) following a POST request to the site (WPScan).

The vendor has released Divi Booster version 5.0.2, which adds proper authorization and CSRF checks to the affected function and removes the unsafe use of unserialize(). Site administrators should upgrade to version 5.0.2 or later immediately. If immediate patching is not possible, disabling the Divi Booster plugin is the recommended interim workaround. Additionally, deploying a Web Application Firewall (WAF) with rules to block suspicious serialized object payloads in file uploads can reduce exposure. Monitor the wtfdivi WordPress option and web server access logs for anomalous POST requests (WPScan, Wordfence).

Wordfence included CVE-2026-2626 in its weekly WordPress vulnerability report for the period of March 9–15, 2026, highlighting it as a notable unauthenticated PHP Object Injection issue (Wordfence). The vulnerability was also noted on Bluesky via the CVE tracking account shortly after disclosure. No significant broader media coverage or threat actor attribution has been reported.