CVE-2026-5524: Divi Form Builder RCE Vulnerability

CVE-2026-5524 Overview

CVE-2026-5524 is an arbitrary file upload vulnerability in the Divi Form Builder plugin for WordPress affecting all versions up to and including 5.1.8. The flaw resides in the do_image_upload() function, which interpolates the attacker-controlled acceptFileTypes POST parameter directly into a validation regular expression. Unauthenticated attackers can upload PHP-executable files to /wp-content/uploads/de_fb_uploads/ and execute arbitrary code by requesting the uploaded file over HTTP. The vulnerability was partially patched in version 5.1.3.

Critical Impact
Unauthenticated attackers can achieve Remote Code Execution on WordPress sites running vulnerable versions of Divi Form Builder, leading to full site takeover.

Affected Products

Divi Form Builder plugin for WordPress, all versions up to and including 5.1.8
WordPress sites running Nginx (where .htaccess protection is completely ineffective)
WordPress sites on Apache where alternate PHP extensions bypass .htaccess rules

Discovery Timeline

2026-07-02 - CVE-2026-5524 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-5524

Vulnerability Analysis

The vulnerability is classified as an Arbitrary File Upload leading to Remote Code Execution [CWE-434]. The do_image_upload() function accepts a client-supplied acceptFileTypes parameter and inserts it into the regular expression used to validate uploaded file names. This design allows attackers to define which extensions are considered valid, effectively neutralizing server-side extension enforcement.

Attackers only need to obtain a WordPress nonce from any public page containing a Divi form. The nonce grants access to the upload endpoint without further authentication. Uploaded files land in the publicly reachable /wp-content/uploads/de_fb_uploads/ directory and can be invoked directly through a browser request.

Root Cause

The root cause is insufficient file extension validation combined with unsafe use of user input in a validation regex. The plugin ships a .htaccess file that blocks execution of .php files, but does not block alternate PHP handlers such as .phtml, .phar, .php5, or .php7. On Nginx-based deployments, .htaccess files are not processed at all, removing the only remaining mitigation.

Attack Vector

The attack path is unauthenticated and network-based. An attacker retrieves a nonce from a public form page, submits a POST request to the vulnerable upload handler with acceptFileTypes set to permit an executable extension such as .phtml, and uploads a PHP payload. The attacker then issues an HTTP GET request to the uploaded file in /wp-content/uploads/de_fb_uploads/ to trigger code execution under the web server user context.

See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-5524

Indicators of Compromise

Presence of files with extensions .phtml, .phar, .php5, or .php7 in /wp-content/uploads/de_fb_uploads/
HTTP POST requests to the Divi Form Builder upload endpoint containing an acceptFileTypes parameter that references PHP-executable extensions
Unexpected HTTP GET requests to files inside /wp-content/uploads/de_fb_uploads/ returning non-image content
Outbound network connections originating from the web server process shortly after uploads to de_fb_uploads

Detection Strategies

Inspect web access logs for POST requests to Divi Form Builder AJAX handlers followed by GET requests to newly created files in the uploads directory
Enable file integrity monitoring on wp-content/uploads/de_fb_uploads/ to alert on the creation of any non-image file
Deploy web application firewall rules that block acceptFileTypes payloads containing PHP extensions

Monitoring Recommendations

Monitor WordPress plugin inventory for Divi Form Builder versions at or below 5.1.8
Alert on php, phtml, phar, php5, or php7 file creation events under any wp-content/uploads/ subdirectory
Track process execution chains where the web server spawns interpreters, shells, or outbound network utilities

How to Mitigate CVE-2026-5524

Immediate Actions Required

Update the Divi Form Builder plugin to a version released after 5.1.8 that fully addresses the flaw
Audit /wp-content/uploads/de_fb_uploads/ for unauthorized files and remove any non-image content
Rotate WordPress secrets, administrator credentials, and API keys if evidence of exploitation is found
Review web server and PHP error logs for signs of code execution originating from the uploads directory

Patch Information

The vendor released a partial fix in version 5.1.3 according to the Divi Form Builder Changelog. All versions up to and including 5.1.8 remain vulnerable. Administrators must upgrade to the latest release that fully remediates the do_image_upload() validation logic. Consult the Wordfence Vulnerability Report for the fixed version reference.

Workarounds

Disable or remove the Divi Form Builder plugin until a fully patched version is deployed
Configure the web server to deny execution of any PHP handler under wp-content/uploads/, including .phtml, .phar, .php5, and .php7
On Nginx, add a location block that returns 403 for requests to /wp-content/uploads/de_fb_uploads/ matching PHP-executable extensions
Deploy a web application firewall rule that strips or rejects the acceptFileTypes parameter from requests to Divi upload endpoints

bash

# Nginx configuration example to block PHP execution in the vulnerable uploads directory
location ~* ^/wp-content/uploads/de_fb_uploads/.*\.(php|phtml|phar|php5|php7)$ {
    deny all;
    return 403;
}