CVE-2026-5524
published 2026-07-02CVE-2026-5524: The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8…
PriorityP187critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
3.48%
89.0th percentile
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically. Additionally, on Nginx-based servers, the .htaccess protection is completely ineffective as Nginx does not process .htaccess files. This makes it possible for unauthenticated attackers (who can obtain a nonce from any public page containing a form) to upload executable PHP files to the publicly accessible /wp-content/uploads/de_fb_uploads/ directory and achieve Remote Code Execution by accessing the uploaded file via HTTP. The vulnerability was partially patched in version 5.1.3.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| divi_engine | divi_form_builder | <= 5.1.8 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Divi Engine Divi Form Builder Plugin up to 5.1.8 on WordPress PHP File de_fb_uploads do_image_upload acceptFileTypes unrestricted upload
vuldb·2026-07-02·CVSS 9.8
CVE-2026-5524 [CRITICAL] Divi Engine Divi Form Builder Plugin up to 5.1.8 on WordPress PHP File de_fb_uploads do_image_upload acceptFileTypes unrestricted upload
A vulnerability classified as critical has been found in Divi Engine Divi Form Builder Plugin up to 5.1.8 on WordPress. This affects the function do_image_upload of the file /wp-content/uploads/de_fb_uploads of the component PHP File Handler. Performing a manipulation of the argument acceptFileTypes results in unrestricted upload.
This vulnerability is reported as CVE-2026-5524. The attack is possible to be carried out remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8.
ghsa_unreviewed·2026-07-02
CVE-2026-5524 [CRITICAL] CWE-434 The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8.
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically. Additionally, on Nginx-based servers, the .htaccess protection is completely ineffective as Nginx does not process .htaccess files. This makes it possible for unauthenticated attackers (who can obtain a nonce from any public page
VulnCheck
Unrestricted Upload of File with Dangerous Type
vulncheck·2026·CVSS 9.8
CVE-2026-5524 [CRITICAL] Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically. Additionally, on Nginx-based servers, the .htaccess protection is completely ineffective as Nginx does not process .htaccess files. This makes it possible for unauthenticated attack
No detection rules found.
Nuclei
Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE
nuclei·CVSS 9.8
CVE-2026-5524 [CRITICAL] Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE
Divi Form Builder
------WebKitFormBoundaryDFB5524PoC--
matchers:
- type: dsl
dsl:
- 'contains(body, "files") && contains(body, "{{fname}}")'
- 'status_code == 200'
condition: and
internal: true
- raw:
- |
GET /wp-content/uploads/de_fb_uploads/{{fname}}.phtml HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'contains(body, "{{md5(marker)}}")'
- 'status_code == 200'
condition: and
# digest: 4a0a004730450221009129ac04e0038c52a428e7740d0e80377cfd9ac8f0b431217a796e06e18f40a902203fc8464a6e5865d1c410f64e7fffb5462e10ef025552cb91f43cd6b32b4df014:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2026-07-02
Published
Exploited in the wild