What the vulnerability does
01Description
The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress's built-in REST API nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the absence of nonce verification means that a forged cross-site request from a logged-in administrator's browser will pass the capability check via the admin's session cookies. This makes it possible for unauthenticated attackers to install arbitrary plugins from WordPress.
Explanation of Vulnerability in Simple Terms
02Summary
Divi Torque Lite versions up to 4.2.3 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the admin's knowledge or consent. This could allow unauthorized changes to site settings, content, or configuration.
What an attacker can do
03Attacker Capabilities
Perform unwanted actions on the site by tricking a logged-in admin into visiting a malicious webpage.
Potential impact on your site
04Site Impact
An attacker can modify site settings, content, or configuration if they trick your admin into clicking a malicious link.
Conditions required to exploit
05Prerequisites
A site admin must visit a page controlled by the attacker while logged into WordPress.
Key dates
06Disclosure timeline
July 9, 2026
CVE published
July 9, 2026
Record updated
