Introduction
A WordPress plugin built to show or hide Divi Builder content based on PHP expressions did what you might fear and evaluated user-supplied PHP code without adequate restrictions. The result is CVE-2026-1829, an authenticated Remote Code Execution vulnerability that lets any user with Contributor-level access run arbitrary code on the server.
Content Visibility for Divi Builder extends the popular Divi theme and page builder (by Elegant Themes). Site administrators use it to display or hide sections and modules depending on whether a PHP boolean expression evaluates to true. The plugin has 2,000+ active installations and has been available since February 2016. It is a niche add-on, but it sits inside the Divi ecosystem, and Divi itself powers a significant share of the WordPress sites that use premium page builders.
Technical Information
Root Cause: PHP Expression Evaluation in Shortcode Parameters
The plugin decides whether content is visible by evaluating PHP expressions that users supply, and that architectural choice is the root cause of CVE-2026-1829. The plugin allows "Sections and Modules to be displayed/hidden based on the outcome of a PHP boolean expression," and the expression is passed through the cvdb_content_visibility_check parameter of the et_pb_text shortcode.
The vulnerable code is in includes/plugin.class.php at line 229 of the version 4.01 codebase. When the shortcode renders, the plugin processes the value of cvdb_content_visibility_check without adequate sanitization or capability checks, so an attacker can inject and execute arbitrary PHP code.
The vulnerability is classified as CWE-94 (Improper Control of Generation of Code), the standard category for code injection flaws in which an application builds code from externally influenced input without properly neutralizing it.
CVSS Breakdown
The CVSS v3.1 base score is 8.8, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
| CVSS Metric | Value | Interpretation |
|---|---|---|
| Attack Vector (AV) | Network | Exploitable remotely over the internet |
| Attack Complexity (AC) | Low | No special conditions required |
| Privileges Required (PR) | Low | Contributor-level access is enough |
| User Interaction (UI) | None | No victim action needed |
| Scope (S) | Unchanged | Impact limited to the vulnerable component |
| Confidentiality (C) | High | Full data compromise possible |
| Integrity (I) | High | Complete data modification possible |
| Availability (A) | High | Denial of service possible |
Attack Flow
The exploitation chain for CVE-2026-1829 is short:
-
Authentication: The attacker gets Contributor-level (or higher) access to the target WordPress site. Contributor is the lowest authoring role in WordPress and is commonly given to guest authors, freelance writers, and content team members.
-
Shortcode Injection: The attacker writes a post containing the
et_pb_textshortcode with a malicious value in thecvdb_content_visibility_checkparameter. Contributors can create and submit draft posts, which gives them access to the shortcode system. -
Code Execution: When the shortcode renders (during preview or when the post is published), the server evaluates the malicious parameter value as PHP code. The attacker now has arbitrary code execution in the context of the web server process.
-
Post-Exploitation: With code running on the server, the attacker can read sensitive files (including
wp-config.phpwith its database credentials), escalate privileges to Administrator, install persistent backdoors, or pivot to other systems the web server can reach.
The privileges required are low and so is the attack complexity, so exploitation is trivial once an attacker understands the vulnerable parameter. Multi-author WordPress sites, sites with open registration, and sites whose Contributor accounts have been compromised through credential stuffing are all viable targets.
Affected Systems and Versions
The vulnerability affects the Content Visibility for Divi Builder WordPress plugin in all versions up to and including 4.02.
The plugin requires:
- WordPress 5.5 or higher
- PHP 7.0 or higher
- Divi theme or Divi Builder plugin version 3 or higher (from Elegant Themes)
The fix arrived in version 5.00, committed in changeset 3543621 on May 22, 2026. As of disclosure, the latest version is 5.02.
Treat any site running a version from the plugin's initial release through 4.02 as vulnerable.
Vendor Security History
Evaluating PHP boolean expressions to decide content visibility was a risky core design from the start, and this RCE is where that risk ended up. The fix in version 5.00 was a significant architectural refactor rather than a simple patch, and the version number reflects it: the plugin jumped from 4.02 directly to 5.00 and skipped the rest of the 4.x line. The changeset message, "Add security scanner and REST API," indicates that the developer restructured how expressions are validated. The new validation is described as preventing "dangerous PHP code from being executed." The developer may also have moved visibility checking to a server-side REST API endpoint instead of evaluating raw PHP in shortcode handlers.
The developer responded promptly during coordinated disclosure and committed the fix approximately 11 days before public disclosure on June 2, 2026.
References
- NVD Entry for CVE-2026-1829
- Wordfence Threat Intelligence Advisory
- Wordfence Plugin Vulnerability Detail
- Vulnerable Code: plugin.class.php Line 229 (Version 4.01)
- Changeset 3543621 (Patch Commit)
- Content Visibility for Divi Builder WordPress Plugin Directory
- ZAST.AI LinkedIn Post on CVE-2026-1829 Discovery
- Content Visibility on Divi FYI
