EUVD-2026-41368
GHSA-7ch9-34jx-wqhr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network upload (PR:N) with a trivially scriptable nonce fetch keeps AC:L; resulting RCE yields full C/I/A impact within the WordPress host (S:U).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically. Additionally, on Nginx-based servers, the .htaccess protection is completely ineffective as Nginx does not process .htaccess files. This makes it possible for unauthenticated attackers (who can obtain a nonce from any public page containing a form) to upload executable PHP files to the publicly accessible /wp-content/uploads/de_fb_uploads/ directory and achieve Remote Code Execution by accessing the uploaded file via HTTP. The vulnerability was partially patched in version 5.1.3.
Articles & Coverage 2
AnalysisAI
Arbitrary file upload leading to remote code execution in the Divi Form Builder WordPress plugin (versions through 5.1.8) lets unauthenticated attackers upload executable PHP files and run arbitrary code on the server. Attacker-controlled input from the acceptFileTypes POST parameter is interpolated directly into the file-validation regex in do_image_upload(), allowing alternate PHP extensions (.phtml, .phar, .php5, .php7) that evade the plugin's .php-only .htaccess block - and on Nginx the .htaccess protection does not apply at all. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 9.8 rating and Wordfence's technical disclosure make this a high-priority patching target.
Technical ContextAI
The affected component is the Divi Form Builder plugin (CPE cpe:2.3:a:divi_engine:divi_form_builder), an add-on that provides form functionality within the widely used Divi/Elegant Themes WordPress ecosystem. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the do_image_upload() function builds a regular expression from the client-supplied acceptFileTypes value and uses it to decide which uploads are allowed, so an attacker who controls that parameter controls the allow-list. The plugin attempts a defense-in-depth control via an .htaccess file that denies execution of *.php, but this is both incomplete (it does not cover .phtml/.phar/.php5/.php7, which many PHP-FPM/mod_php configurations still execute) and platform-dependent (Nginx ignores .htaccess entirely, nullifying the control). Uploaded files land in the world-reachable /wp-content/uploads/de_fb_uploads/ directory, so a successful upload is directly requestable over HTTP.
RemediationAI
Because the description marks version 5.1.3 as only a partial fix and lists all versions up to and including 5.1.8 as vulnerable, no fully patched release is independently confirmed from the available data; consult the vendor changelog at https://diviengine.com/divi-form-builder-changelog/ and upgrade to the newest release published after 5.1.8 that explicitly notes the file-upload fix, and confirm the fixed version with the vendor before relying on it. As immediate compensating controls, restrict or block public HTTP access to /wp-content/uploads/de_fb_uploads/ and configure the web server to refuse execution of PHP in the uploads tree - critically, do this at the server level rather than via .htaccess, e.g. an Nginx location block that returns 403 for \.ph(p[0-9]?|tml|ar)$ under /wp-content/uploads/, since Nginx ignores .htaccess and the plugin's default rule only covers .php (side effect: legitimate uploads with those extensions, which should not exist, are blocked). If forms are not needed, deactivate the Divi Form Builder plugin, or place the site behind a WAF/virtual patch (Wordfence provides one per its advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/9692deb2-2526-4983-8a13-93a382e230c8?source=cve) as a stopgap. Review the de_fb_uploads directory for already-uploaded PHP/phtml/phar files as a compromise check.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today