Divi Engine Divi Form Builder vulnerabilities

CVE-2026-5524 [CRITICAL] CWE-434 CVE-2026-5524: The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular

CVE-2026-5118 [CRITICAL] CWE-269 CVE-2026-5118: The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticat

CVE-2026-5523 [HIGH] CWE-639 CVE-2026-5523: The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the update_user() function accepting a user ID parameter from form submissions without verifying that the authenticated user has permission to edit that specific user account, and the handle_register_submission() func