CVE-2026-19660

{
  "etk_id": "ETK-2026-299",
  "cve_id": "CVE-2026-19660",
  "display_id": "CVE-2026-19660",
  "ghsa_id": "GHSA-fwjj-2936-g23h",
  "euvd_id": "EUVD-2026-91170",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in Divi Membership",
  "summary": "Divi Membership for WordPress through version 2.3.0 does not properly validate a payment callback before creating a user session. An unauthenticated attacker may sign in as an existing site user, potentially including an administrator. The affected callback is reachable even when the PayPal integration is not configured or enabled.",
  "mitigation": "Disable and remove Divi Membership from affected WordPress sites until a vendor-fixed release is available. Review administrator accounts and active sessions for signs of unauthorized access.",
  "vendor": "DiviEngine",
  "product": "Divi Membership",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.3.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Divi Membership",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.004,
  "epss_percentile": 0.3245,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 28.142139266666668,
  "t0_at": "2026-10-02T04:27:11.341000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-02T07:18:40.473619+00:00",
      "days": 0.11908718309027778,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T04:27:11.341000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-02T04:27:11.341000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T04:27:11.341000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19660"
    }
  }
}