Divi Form Builder Plugin Vulnerable to Unauthenticated RCE (CVE-2026-5524)

The Divi Form Builder plugin for WordPress, impacting all versions up to and including 5.1.8, is susceptible to an Arbitrary File Upload vulnerability (CVE-2026-5524) that can lead to Remote Code Execution. This flaw stems from inadequate validation of file extensions within the do_image_upload() function. Attackers can leverage a critical oversight where the acceptFileTypes POST parameter's user-supplied input is directly interpolated into a regular expression used for file validation. This allows unauthenticated attackers to specify PHP-executable extensions like .phtml, .phar, .php5, or .php7, effectively bypassing the plugin's .htaccess protection, which only blocks .php files. The issue is further exacerbated on Nginx-based servers, where .htaccess files are not processed, rendering this protective measure completely ineffective. By obtaining a nonce from any public page displaying a form, threat actors can upload malicious PHP files to the /wp-content/uploads/de_fb_uploads/ directory and execute them remotely via HTTP, gaining full control over the compromised WordPress instance.

Attack Chain

1. Initial Access: An unauthenticated attacker identifies a public WordPress page containing a Divi Form Builder form.
2. Information Gathering: The attacker requests the public page via HTTP to obtain a valid nonce value from the page's source code, which is required for subsequent requests.
3. Exploitation Request: The attacker crafts a malicious HTTP POST request targeting the Divi Form Builder's file upload functionality, likely to an admin-ajax.php endpoint with a specific action parameter.
4. Parameter Manipulation: The crafted POST request includes a manipulated acceptFileTypes parameter, specifying a PHP-executable extension such as .phtml, .php5, .php7, or .phar to bypass the plugin's insufficient validation logic.
5. Malicious File Upload: The attacker includes a PHP webshell within the POST request, which is then uploaded to the server and stored in the publicly accessible /wp-content/uploads/de_fb_uploads/ directory.
6. Remote Code Execution: The attacker accesses the newly uploaded webshell via a direct HTTP GET request to its URL (e.g., https://example.com/wp-content/uploads/de_fb_uploads/shell.phtml), executing arbitrary commands on the compromised server.
7. Post-Exploitation: With remote code execution, the attacker can proceed with further compromise, including data exfiltration, website defacement, privilege escalation, or deploying additional malware.

Impact

Successful exploitation of CVE-2026-5524 leads to unauthenticated Remote Code Execution on the affected WordPress site. This means attackers can execute arbitrary commands, potentially leading to complete website compromise, data theft from the underlying database, defacement of web content, or the installation of backdoors and other malicious software. For organizations, this can result in significant financial losses, reputational damage, regulatory fines due to data breaches, and a persistent foothold for further network intrusion. While specific victim counts are not available, all users of the vulnerable Divi Form Builder plugin are at risk, particularly those running on Nginx servers where .htaccess protections are ineffective.

Recommendation

• Patch CVE-2026-5524: Immediately update the Divi Form Builder plugin to a version greater than 5.1.8 to remediate CVE-2026-5524.
• Deploy Sigma Rule: Deploy the CVE-2026-5524-Divi-Form-Builder-Webshell-Access Sigma rule to your webserver logs to detect post-exploitation activity.
• Implement Server-Side Restrictions: For Nginx servers, ensure configurations explicitly disallow the execution of PHP files within upload directories, such as /wp-content/uploads/de_fb_uploads/, by default.
• Monitor WordPress Logs: Enable comprehensive logging for your WordPress environment, including access to web server logs, to capture requests to plugin-specific endpoints and access attempts to suspicious files.