WordPress Divi Membership plugin <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter vulnerability

Unauthenticated Authentication Bypass via 'paypalparam' Parameter vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin Divi Membership versions = 2.3.0...

EUVD-2026-91170

The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The processpaypalcallback function, hooked to the init action, accepts a base64-encoded paypalparam GET parameter with no IPN validation, no cryptographic signature check, ...

CVE-2026-19660

The Divi Membership plugin for WordPress (versions up to and including 2.3.0 ) is vulnerable to an Authentication Bypass via the process_paypal_callback function. This function, hooked to the init action, accepts a base64-encoded paypal_param GET parameter without IPN validation , cryptographic s...