Divi Form Builder Plugin <= 5.1.8 (<= 5.1.8)

The Divi Form Builder plugin for WordPress, in versions up to and including 5.1.8, is vulnerable to arbitrary file upload leading to remote code execution due to insufficient file extension validation where user-supplied input is interpolated into a regular expression, allowing unauthenticated attackers to bypass .htaccess protections with specific PHP-executable extensions and upload malicious PHP files to the /wp-content/uploads/de_fb_uploads/ directory for remote execution, particularly on Nginx-based servers where .htaccess is ineffective.