6 matches found
CVE-2026-19660
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The processpaypalcallback function, hooked to the init action, accepts a base64-encoded paypalparam GET parameter with no IPN validation, no cryptographic signature check, ...
CVE-2026-19660
The Divi Membership plugin for WordPress (versions up to and including 2.3.0 ) is vulnerable to an Authentication Bypass via the process_paypal_callback function. This function, hooked to the init action, accepts a base64-encoded paypal_param GET parameter without IPN validation , cryptographic s...
EUVD-2026-91170
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The processpaypalcallback function, hooked to the init action, accepts a base64-encoded paypalparam GET parameter with no IPN validation, no cryptographic signature check, ...
CVE-2026-19660 Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The processpaypalcallback function, hooked to the init action, accepts a base64-encoded paypalparam GET parameter with no IPN validation, no cryptographic signature check, ...
CVE-2026-19660 Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The processpaypalcallback function, hooked to the init action, accepts a base64-encoded paypalparam GET parameter with no IPN validation, no cryptographic signature check, ...
CVE-2026-19660: Improper Authentication
The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The processpaypalcallback function, hooked to the init action, accepts a base64-encoded paypalparam GET parameter with no IPN validation, no cryptographic signature check, ...