Is CVE-2026-5524 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5524 being exploited in the wild.

How severe is CVE-2026-5524?

Critical severity, with a CVSS score of 9.8, published 2 July 2026.

Which products and versions are affected?

Divi Engine Divi Form Builder up to and including 5.1.8.

Is there a fix for CVE-2026-5524?

A patch was published on 2026-05-24: Security hardening for file uploads released in version 5.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5524 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5524?

Check whether you run Divi Engine Divi Form Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5524: Divi Engine Divi Form Builder arbitrary file upload in do_image_upload

CVE-2026-5524 · Severity: critical · CVSS 9.8 · Published 2026-07-02

The Divi Form Builder plugin for WordPress, which allows site owners to create custom contact and data entry forms, contains a critical security flaw. An unauthenticated attacker can bypass security checks to upload malicious files directly to the web server. If successful, this allows the attacker to take complete control of the website, potentially leading to data theft, site defacement, or the installation of further malware.

Technologies: Divi Engine Divi Form Builder. Vendors: Divi Engine.

Quick answers

Is CVE-2026-5524 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5524 being exploited in the wild.
How severe is CVE-2026-5524?: Critical severity, with a CVSS score of 9.8, published 2 July 2026.
Which products and versions are affected?: Divi Engine Divi Form Builder up to and including 5.1.8.
Is there a fix for CVE-2026-5524?: A patch was published on 2026-05-24: Security hardening for file uploads released in version 5.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5524 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5524?: Check whether you run Divi Engine Divi Form Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. The flaw exists in the do_image_upload() function where user-supplied input from the 'acceptFileTypes' POST parameter is directly interpolated into a regular expression used for file validation. This allows unauthenticated attackers to specify PHP-executable extensions (e.g., .phtml, .phar, .php5) that bypass the plugin's .htaccess protection, which only explicitly blocks .php files. Furthermore, the .htaccess protection is ineffective on Nginx-based servers. Attackers can obtain a necessary nonce from any public page containing a form, upload a malicious file to the /wp-content/uploads/de_fb_uploads/ directory, and execute it via a direct HTTP request. The vulnerability was fully addressed in version 5.1.9.

Affected products

Divi Engine Divi Form Builder up to and including 5.1.8

Timeline

2026-05-24: patched: Security hardening for file uploads released in version 5.1.9.
2026-07-02: advisory: NVD and Wordfence published advisory details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.