Summary
A critical vulnerability, CVE-2026-5524, has been identified in the Divi Form Builder plugin for WordPress by Divi Engine, affecting all versions up to and including 5.1.8. The flaw is an unrestricted arbitrary file upload (CWE-434) in the do_image_upload() function that enables unauthenticated remote attackers to upload PHP-executable files and achieve full Remote Code Execution (RCE) on the underlying server. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).
Technical details
- Root cause: User-supplied input from the
acceptFileTypesPOST parameter is directly interpolated into a regular expression used to validate uploaded file extensions indo_image_upload(). This allows an attacker to specify arbitrary PHP-executable extensions such as.phtml,.phar,.php5, or.php7, bypassing the plugin’s validation logic entirely. - Incomplete server-side protection: The plugin deploys an
.htaccessfile in the upload directory (/wp-content/uploads/de_fb_uploads/) that blocks.phpfiles specifically. Because the extension check uses the attacker-controlled regex, alternative PHP-executable extensions bypass this rule entirely. On Nginx-based servers,.htaccessfiles are not processed at all, removing even this partial safeguard. - Trigger conditions: An attacker must supply a valid WordPress nonce, which is embedded in any public page containing a Divi Form Builder form and is therefore freely accessible to any unauthenticated visitor. This makes the effective barrier to exploitation negligible.
- Attack vector: Entirely remote over HTTP — no authentication, no user interaction, and no elevated privileges are required (CVSS: AV:N/AC:L/PR:N/UI:N).
- Impact: Uploaded PHP files are stored in the publicly accessible
/wp-content/uploads/de_fb_uploads/directory. Accessing the uploaded file via a standard HTTP GET request executes arbitrary PHP code on the server, resulting in full Remote Code Execution with potential for complete system compromise, data exfiltration, and lateral movement (CVSS: C:H/I:H/A:H).
Affected software
- Divi Form Builder by Divi Engine for WordPress — all versions up to and including 5.1.8
- A partial fix was introduced in version 5.1.3, which addressed one code path but left the core injection flaw unresolved; versions 5.1.3 through 5.1.8 remain fully vulnerable.
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- No fully patched version has been confirmed as of the publication of this advisory (July 2, 2026). The vendor’s partial fix in version 5.1.3 does not resolve the underlying vulnerability; all sites running version 5.1.8 or below should treat the plugin as unpatched.
- Immediate actions:
- Monitor the Divi Engine changelog and apply any security release as soon as it becomes available.
- If the plugin cannot be updated promptly, consider disabling the file/image upload field type within the form builder to eliminate the vulnerable code path until a full patch is released.
- On Apache-based servers, audit and harden the
.htaccessfile in/wp-content/uploads/de_fb_uploads/to deny execution of all script file types, not just.php. - On Nginx-based servers, add explicit
locationblock rules to deny PHP execution within the uploads directory, as.htaccessprovides no protection in this configuration. - Review the
/wp-content/uploads/de_fb_uploads/directory for any unexpectedly uploaded files with PHP-executable extensions, which may indicate prior exploitation.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.