PT-2026-55198 · WordPress · Divi Form Builder

0Xd4Rk5Id3 · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-5524

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Divi Form Builder versions prior to 5.1.9

Description Insufficient file extension validation in the do image upload() function allows unauthenticated attackers to perform arbitrary file uploads, leading to Remote Code Execution. The issue occurs because user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used for validation. Attackers can bypass .htaccess protections by using PHP-executable extensions such as .phtml, .phar, .php5, or .php7. On Nginx-based servers, the .htaccess protection is entirely ineffective. An attacker can obtain a nonce from any public page containing a form to upload executable PHP files to the /wp-content/uploads/de fb uploads/ directory and execute them via HTTP.

Recommendations Update Divi Form Builder to version 5.1.9 or later. As a temporary mitigation, restrict access to the /wp-content/uploads/de fb uploads/ directory to prevent the execution of uploaded files.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-5524

Affected Products

Divi Form Builder

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-5524 · Security Note
• https://diviengine.com/divi-form-builder-changelog · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9692deb2-2526-4983-8a13-93a382e230c8?source=cve · Note
• https://reddit.com/r/pwnhub/comments/1ulr7r2/the_divi_form_builder_plugin_for_wordpress_is · Reddit Post