Divi Form Builder CVE-2026-5524

Exploitation requires that the target run the Divi Form Builder plugin at version 5.1.8 or earlier with at least one publicly reachable page containing a Divi form, since the attacker must first harvest a valid nonce from that page. The attacker then abuses the acceptFileTypes POST parameter of the do_image_upload() function to whitelist a PHP-executable extension. Exploitation is materially easier - and the plugin's built-in .htaccess mitigation is entirely bypassed - on Nginx-based servers; on Apache/mod_php it still succeeds because the .htaccess rule blocks only literal .php while .phtml/.phar/.php5/.php7 remain executable in typical configs. Limiting factors: a public form (hence an obtainable nonce) must exist, the uploaded extension must be one the server maps to the PHP interpreter, and the de_fb_uploads directory must be web-accessible; there is no authentication or user-interaction requirement.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) is internally consistent with the description: network-reachable, low-complexity, no privileges or user interaction, full compromise of confidentiality, integrity, and availability via code execution. One nuance to verify: exploitation requires obtaining a valid nonce from a public page that contains a form, which is trivial to script but is a real precondition - it slightly raises attack complexity in practice without changing the unauthenticated nature, so PR:N remains appropriate. No EPSS score, KEV entry, or public POC is present in the provided data, so real-world exploitation cannot be confirmed; the signals available (unauthenticated RCE, popular ecosystem, credible Wordfence disclosure) point to genuine high priority rather than a high-CVSS/low-real-risk case, but the absence of exploitation telemetry should temper claims of active abuse. A notable complication: the description states the flaw was only 'partially patched' in 5.1.3 yet lists all versions through 5.1.8 as vulnerable, meaning even the latest analyzed release is affected - verify a fully fixed version with the vendor before assuming remediation.

An unauthenticated attacker scrapes a nonce from any public page hosting a Divi form, then submits a crafted multipart upload setting acceptFileTypes so the validation regex permits a .phtml (or .phar/.php5/.php7) payload. The malicious file is written to the public /wp-content/uploads/de_fb_uploads/ directory, and the attacker fetches it over HTTP to execute a web shell - trivially reliable on Nginx where the .htaccess safeguard has no effect. No public POC is identified at time of analysis, but the low attack complexity and network attack vector make weaponization straightforward.