CVE-2026-5524

CVE

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

July 2, 2026

Last Seen

July 3, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical RCE Vulnerability in Divi Form Builder Plugin for WordPress78.0

The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload, allowing Remote Code Execution in all versions up to 5.1.8. This vulnerability arises from insufficient file extension validation in the do_image_upload() function, enabling attackers to upload executable PHP files by...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical RCE Vulnerability in Divi Form Builder Plugin for WordPress

Jul 3·9 sources

Related Articles (2)

CVE-2026-5524 INCIBE-CERT - Vulnerabilities RSS / 22h The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically.

www.incibe.es·Jul 3

CVE-2026-5524 - Exploits & Severity

Related Entities

Zero-day Exploit Cwe-434 - Unrestricted Upload Of File With Dangerous Type CWE-287 - Improper Authentication T1505.003 - Web Shell T1190 - Exploit Public-Facing Application WordPress Nginx