Cross-site request forgery in badhonrocks Divi Torque Lite – Divi Modules for the Divi…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.
Summary
The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress's built-in REST API nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the absence of nonce verification means that a forged cross-site request from a logged-in administrator's browser will pass the capability check via the admin's session cookies. This makes it possible for unauthenticated attackers to install arbitrary plugins from WordPress.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| badhonrocks | Divi Torque Lite – Divi Modules for the Divi Builder & Theme | up to 4.2.3 | — | No fix listed | CNA |
- Divi Torque Lite – Divi Modules for the Divi Builder & Theme Vendorbadhonrocks Affected up to 4.2.3 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4275
- 2026-10-03 Alias added: GHSA-ggxj-99vw-g2xw
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8be98cba-b891-42cf-8a6c-8fe05f27c9c3?source=cve
- https://plugins.trac.wordpress.org/browser/addons-for-divi/tags/4.2.2/includes/rest-api.php#L81
- https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/rest-api.php#L81
- https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/rest-api.php#L230
- https://plugins.trac.wordpress.org/browser/addons-for-divi/tags/4.2.2/includes/rest-api.php#L230
- https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/rest-api.php#L75
- https://plugins.trac.wordpress.org/browser/addons-for-divi/tags/4.2.2/includes/rest-api.php#L75
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3559041%40addons-for-divi&new=3559041%40addons-for-divi
More badhonrocks vulnerabilities
- TI-2025-00286 Divi Torque Lite <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVSS 3.1MEDIUM 6.4
- TI-2024-05243 Cross-site scripting in BlossomThemes Social Feed CVSS 3.1MEDIUM 6.4
- TI-2024-05463 Cross-site scripting in badhonrocks Divi Torque Lite – Divi Theme, Divi Builder & Extra… CVSS 3.1MEDIUM 6.4
- TI-2022-04562 Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 3.1MEDIUM 6.3
Sources
- CVE-2026-4275 · CVE Program
- CVE-2026-4275 · NVD
- FIRST EPSS
- GHSA-ggxj-99vw-g2xw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences