{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/divi-form-builder-plugin--5.1.8--5.1.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:divi:form_builder_plugin_5_1_8:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-5524"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-IICAICAI-CVE-2026-5524-POC\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Divi Form Builder plugin \u003c= 5.1.8 (\u003c= 5.1.8)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","plugin-vulnerability","rce","webserver","php"],"_cs_type":"advisory","_cs_vendors":["Divi"],"content_html":"\u003cp\u003eThe Divi Form Builder plugin for WordPress, impacting all versions up to and including 5.1.8, is susceptible to an Arbitrary File Upload vulnerability (CVE-2026-5524) that can lead to Remote Code Execution. This flaw stems from inadequate validation of file extensions within the \u003ccode\u003edo_image_upload()\u003c/code\u003e function. Attackers can leverage a critical oversight where the \u003ccode\u003eacceptFileTypes\u003c/code\u003e POST parameter's user-supplied input is directly interpolated into a regular expression used for file validation. This allows unauthenticated attackers to specify PHP-executable extensions like \u003ccode\u003e.phtml\u003c/code\u003e, \u003ccode\u003e.phar\u003c/code\u003e, \u003ccode\u003e.php5\u003c/code\u003e, or \u003ccode\u003e.php7\u003c/code\u003e, effectively bypassing the plugin's \u003ccode\u003e.htaccess\u003c/code\u003e protection, which only blocks \u003ccode\u003e.php\u003c/code\u003e files. The issue is further exacerbated on Nginx-based servers, where \u003ccode\u003e.htaccess\u003c/code\u003e files are not processed, rendering this protective measure completely ineffective. By obtaining a nonce from any public page displaying a form, threat actors can upload malicious PHP files to the \u003ccode\u003e/wp-content/uploads/de_fb_uploads/\u003c/code\u003e directory and execute them remotely via HTTP, gaining full control over the compromised WordPress instance.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access\u003c/strong\u003e: An unauthenticated attacker identifies a public WordPress page containing a Divi Form Builder form.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInformation Gathering\u003c/strong\u003e: The attacker requests the public page via HTTP to obtain a valid nonce value from the page's source code, which is required for subsequent requests.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExploitation Request\u003c/strong\u003e: The attacker crafts a malicious HTTP POST request targeting the Divi Form Builder's file upload functionality, likely to an \u003ccode\u003eadmin-ajax.php\u003c/code\u003e endpoint with a specific action parameter.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eParameter Manipulation\u003c/strong\u003e: The crafted POST request includes a manipulated \u003ccode\u003eacceptFileTypes\u003c/code\u003e parameter, specifying a PHP-executable extension such as \u003ccode\u003e.phtml\u003c/code\u003e, \u003ccode\u003e.php5\u003c/code\u003e, \u003ccode\u003e.php7\u003c/code\u003e, or \u003ccode\u003e.phar\u003c/code\u003e to bypass the plugin's insufficient validation logic.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalicious File Upload\u003c/strong\u003e: The attacker includes a PHP webshell within the POST request, which is then uploaded to the server and stored in the publicly accessible \u003ccode\u003e/wp-content/uploads/de_fb_uploads/\u003c/code\u003e directory.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRemote Code Execution\u003c/strong\u003e: The attacker accesses the newly uploaded webshell via a direct HTTP GET request to its URL (e.g., \u003ccode\u003ehttps://example.com/wp-content/uploads/de_fb_uploads/shell.phtml\u003c/code\u003e), executing arbitrary commands on the compromised server.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePost-Exploitation\u003c/strong\u003e: With remote code execution, the attacker can proceed with further compromise, including data exfiltration, website defacement, privilege escalation, or deploying additional malware.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-5524 leads to unauthenticated Remote Code Execution on the affected WordPress site. This means attackers can execute arbitrary commands, potentially leading to complete website compromise, data theft from the underlying database, defacement of web content, or the installation of backdoors and other malicious software. For organizations, this can result in significant financial losses, reputational damage, regulatory fines due to data breaches, and a persistent foothold for further network intrusion. While specific victim counts are not available, all users of the vulnerable Divi Form Builder plugin are at risk, particularly those running on Nginx servers where \u003ccode\u003e.htaccess\u003c/code\u003e protections are ineffective.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-5524\u003c/strong\u003e: Immediately update the Divi Form Builder plugin to a version greater than 5.1.8 to remediate CVE-2026-5524.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy Sigma Rule\u003c/strong\u003e: Deploy the \u003ccode\u003eCVE-2026-5524-Divi-Form-Builder-Webshell-Access\u003c/code\u003e Sigma rule to your webserver logs to detect post-exploitation activity.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement Server-Side Restrictions\u003c/strong\u003e: For Nginx servers, ensure configurations explicitly disallow the execution of PHP files within upload directories, such as \u003ccode\u003e/wp-content/uploads/de_fb_uploads/\u003c/code\u003e, by default.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMonitor WordPress Logs\u003c/strong\u003e: Enable comprehensive logging for your WordPress environment, including access to web server logs, to capture requests to plugin-specific endpoints and access attempts to suspicious files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T06:58:42Z","date_published":"2026-07-02T13:41:41Z","id":"https://feed.craftedsignal.io/briefs/2026-07-divi-form-builder-rce/","summary":"The Divi Form Builder plugin for WordPress, in versions up to and including 5.1.8, is vulnerable to arbitrary file upload leading to remote code execution due to insufficient file extension validation where user-supplied input is interpolated into a regular expression, allowing unauthenticated attackers to bypass .htaccess protections with specific PHP-executable extensions and upload malicious PHP files to the /wp-content/uploads/de_fb_uploads/ directory for remote execution, particularly on Nginx-based servers where .htaccess is ineffective.","title":"Divi Form Builder Plugin Vulnerable to Unauthenticated RCE (CVE-2026-5524)","url":"https://feed.craftedsignal.io/briefs/2026-07-divi-form-builder-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Divi Form Builder Plugin \u003c= 5.1.8 (\u003c= 5.1.8)","version":"https://jsonfeed.org/version/1.1"}