CVE-2026-5524 is a critical vulnerability in the Divi Form Builder WordPress plugin caused by insufficient validation of file extensions in the do_image_upload() function. The plugin uses user-supplied input from the acceptFileTypes POST parameter directly in a regular expression to validate uploads, allowing attackers to specify dangerous PHP-executable extensions beyond .php. The plugin's .htaccess file only blocks .php files, so extensions like .phtml, .phar, .php5, and .php7 can bypass this protection. Moreover, on Nginx-based servers, .htaccess files are ignored, rendering the protection ineffective. Unauthenticated attackers can obtain a nonce from any public page with a form and upload executable PHP files to the publicly accessible /wp-content/uploads/de_fb_uploads/ directory, leading to remote code execution upon HTTP access. Although a partial patch was released in version 5.1.3, versions up to 5.1.8 remain vulnerable.

Successful exploitation allows unauthenticated remote attackers to upload arbitrary executable PHP files to the server, leading to full remote code execution. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability is critical with a CVSS score of 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A partial patch was introduced in version 5.1.3, but versions up to and including 5.1.8 remain vulnerable. Until an official fix is confirmed, restrict access to the /wp-content/uploads/de_fb_uploads/ directory, disable file uploads if possible, and consider using a web application firewall to block suspicious upload attempts. Monitor vendor channels for an official patch or update addressing this vulnerability.