CVE-2026-1829: Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution

Synopsis

Remote code execution vulnerability in the Content Visibility for Divi Builder WordPress plugin (versions up to and including 4.02). An attacker with at minimum a Contributor-level account can send a crafted shortcode parameter over the network and execute arbitrary code on the server, requiring no victim interaction. Successful exploitation gives the attacker full control over server-side code execution, enabling data theft, file tampering, or complete host compromise. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress instance via HTTP or HTTPS to deliver the malicious shortcode parameter.

• AuthenticationRequired

  A valid WordPress account at Contributor privilege level or higher is required; any low-privilege registered account is sufficient to trigger the vulnerability.

• Victim interactionNot required

  No victim action is needed - the attacker sends the malicious request directly and the server processes it without any user having to click a link or open a file.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and straightforward with no race conditions, special memory layout, or environmental prerequisites required.

Blast Radius

• Executes arbitrary server-side code under the web server process account, giving the attacker a foothold on the underlying host.
• Reads any files accessible to the web server process, including WordPress configuration files that contain database credentials and secret keys.
• Writes or overwrites files on the server, enabling webshell deployment, plugin replacement, or corruption of site content.
• Causes full service disruption by terminating processes, exhausting resources, or deleting critical application files.