Executive brief
The Divi Form Builder plugin for WordPress, which allows site owners to create custom contact and data entry forms, contains a critical security flaw. An unauthenticated attacker can bypass security checks to upload malicious files directly to the web server. If successful, this allows the attacker to take complete control of the website, potentially leading to data theft, site defacement, or the installation of further malware.
Technical details
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. The flaw exists in the do_image_upload() function where user-supplied input from the 'acceptFileTypes' POST parameter is directly interpolated into a regular expression used for file validation. This allows unauthenticated attackers to specify PHP-executable extensions (e.g., .phtml, .phar, .php5) that bypass the plugin's .htaccess protection, which only explicitly blocks .php files. Furthermore, the .htaccess protection is ineffective on Nginx-based servers. Attackers can obtain a necessary nonce from any public page containing a form, upload a malicious file to the /wp-content/uploads/de_fb_uploads/ directory, and execute it via a direct HTTP request. The vulnerability was fully addressed in version 5.1.9.
Affected products
- Divi Engine Divi Form Builder up to and including 5.1.8
Timeline
- 2026-05-24: patched: Security hardening for file uploads released in version 5.1.9.
- 2026-07-02: advisory: NVD and Wordfence published advisory details.