Atomic Edge analysis of CVE-2026-5524 (metadata-based):
This is a critical Unrestricted File Upload vulnerability in the Divi Form Builder plugin for WordPress (versions 5.1.8 and earlier). The flaw allows unauthenticated attackers to upload arbitrary executable PHP files to the server, leading to Remote Code Execution (RCE). The vulnerability carries a CVSS score of 9.8, indicating the highest severity due to network-based, low-complexity exploitation without authentication.
Root Cause: Based on the CWE classification (CWE-434: Unrestricted Upload of File with Dangerous Type) and the vulnerability description, the root cause lies in the do_image_upload() function. This function directly interpolates user-supplied input from the POST parameter ‘acceptFileTypes’ into a regular expression used to validate uploaded file extensions. The plugin’s .htaccess protection only blocks files with the .php extension, but attackers can specify alternative PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass this restriction. On Nginx-based servers, the .htaccess file is completely ineffective because Nginx does not process these files. This analysis is inferred from the CVE description, as no source code diff is available. However, the pattern of interpolating user input into a regex for file validation is a well-known anti-pattern that directly leads to this vulnerability.
Exploitation: An unauthenticated attacker must first obtain a valid nonce from any public page that contains a Divi form. The nonce can be extracted from the page’s HTML source or JavaScript. Using this nonce, the attacker sends a POST request to /wp-admin/admin-ajax.php with the action parameter set to the plugin’s AJAX upload handler (likely ‘de_fb_upload’ or similar). The attacker includes a crafted ‘acceptFileTypes’ POST parameter set to a regex that matches PHP-executable extensions (e.g., “.(php[57]?|phtml|phar)$”). The attacker also includes a file upload with a malicious PHP file bearing one of these extensions (e.g., shell.php5). The server then validates the file against the attacker-controlled regex, accepts the file, and stores it to the publicly accessible directory /wp-content/uploads/de_fb_uploads/. The attacker can then access the uploaded file via HTTP to execute arbitrary PHP code on the server.
Remediation: The fix requires multiple security improvements. First, the plugin must not use user-supplied input from the ‘acceptFileTypes’ parameter in the file extension validation regex. Instead, the plugin should implement a server-side whitelist of allowed file extensions, hardcoded or securely configured. Second, the do_image_upload() function should validate file extensions against this whitelist, using proper extension checking (e.g., pathinfo() with PATHINFO_EXTENSION). Third, the uploaded file should be renamed to a secure extension (e.g., .jpg for images) to prevent any executable code embedded in the file from being executed. Fourth, the .htaccess protection in the upload directory should be broadened to block all PHP-executable extensions, not just .php. The plugin developer should also consider moving uploaded files outside the web root or using a random hash-based filename with no extension.
Impact: Successful exploitation allows an unauthenticated attacker to upload a malicious PHP file to the server and execute arbitrary code. This can lead to full site compromise, including data theft (user credentials, database contents), privilege escalation to administrator-level access, server-side attacks (e.g., lateral movement to other applications), defacement, malware distribution, and complete takeover of the WordPress installation. The critical CVSS score reflects the complete compromise of confidentiality, integrity, and availability.
