Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE

The Divi Form Builder plugin for WordPress versions 5.1.8 and prior contains an unauthenticated arbitrary file upload vulnerability in the doimageupload AJAX handler. The user-controlled acceptFileTypes POST parameter is injected unsanitized into a PHP regex for file extension validation. By...

CVE-2026-5524-PoC

CVE-2026-5524 — Divi Form Builder 未認証RCE CVE-2026-5524 のための大量エクスプロイトツールキット。WordPressプラグイン Divi Form Builder = 5.1.8 における未認証の任意ファイルアップロード脆弱性で、リモートコード実行に至ります。 項目| 値 ---|--- CVE| 2026-5524 CVSS| 9.8 Critical Vector| AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 影響を受けるバージョン| Divi Form Builder = 5.1.8 修正済み| 5.1...

CVE-2026-5524: Unrestricted Upload of File with Dangerous Type

The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the doimageupload function where user-supplied input from the acceptFileTypes POST...