Critical Auth Bypass in Divi Membership Lets Attackers Log In as Any User

A critical pre-authentication authentication-bypass (CVE-2026-19660, CVSS 9.8) in the Divi Membership WordPress plugin (<= 2.3.0) allows an attacker to supply a base64-encoded `paypal_param` that is trusted and used to call wp_set_current_user() and wp_set_auth_cookie(), enabling full account takeover (including administrators). The report details the root cause (unvalidated parameter and unconditional PayPal gateway initialization), exploitation steps, impact, and remediation guidance (update to Divi Membership 3.0.0, plugin deactivation, account audits, and WAF rules).