CVE-2026-5524 INCIBE-CERT - Vulnerabilities RSS / 22h The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically.

www.incibe.es • July 3, 2026

Puntuación base: 9.80 CRÍTICA Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de acceso (AV): A través de red Complejidad de acceso (AC): Bajo Privilegios Requeridos (PR): Ninguno Interacción del usuario (UI): Ninguno Alcance (S): Sin modificar Impacto a la confidencialidad (C): Alto Impacto a la integridad (I): Alto Impacto a la disponibilidad (A): Alto

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Divi Form Builder Plugin for WordPress The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload, allowing Remote Code Execution in all versions up to 5.1.8. This vulnerability arises from insufficient file extension validation in the do_image_upload() function, enabling attackers to upload executable PHP files by bypassing .htaccess protections. Attackers can exploit this flaw without authentication if they obtain a nonce from public pages. The vulnerability has a CVSS score of 9.8, indicating critical severity. Despite a partial patch in version 5.1.3, the issue remains unaddressed in subsequent versions. Organizations, especially those using Nginx servers, are advised to update to versions beyond 5.1.8 and implement additional server-level protections. Currently, there is no evidence of proof-of-concept exploits or active exploitation in the wild. 9 sources 78

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)