CVE-2026-5524 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-5524 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-5524 is an arbitrary file upload vulnerability in the Divi Form Builder plugin for WordPress, affecting all versions up to and including 5.1.8, which can lead to remote code execution on the hosting server.

Technical Detail

The flaw stems from insufficient file extension validation in the plugin's form submission handling, allowing an unauthenticated or low-privileged attacker to upload files with executable extensions (such as .php) to the web server. Once a malicious file is successfully uploaded and placed in a web-accessible directory, the attacker can trigger execution by sending an HTTP request to the uploaded file's path, achieving remote code execution under the web server's process context. Full compromise of the WordPress installation and potentially the underlying host is possible depending on server configuration and privilege boundaries.

Exploitation Status

No known exploit has been publicly documented or observed as of July 09, 2026. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The exploit maturity is currently assessed as no known exploit, meaning no public proof-of-concept code or confirmed in-the-wild exploitation has been recorded. Given the critical CVSS score of 9.8 and the straightforward nature of file upload abuse, the barrier to exploitation is low and this status should be monitored closely.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been identified in connection with this vulnerability. Organizations should not interpret the absence of attribution as an indicator of low risk, particularly given the wide deployment of Divi-based WordPress sites.

What To Do

Update the Divi Form Builder plugin to a version beyond 5.1.8 immediately once a patched release is available from the vendor. Administrators should verify the current installed version and check the plugin's official repository or vendor advisory for a remediated release. As an interim measure, consider disabling the plugin entirely if form submission functionality is not operationally critical. Web application firewall rules should be configured to block upload requests containing executable file extensions targeting WordPress plugin endpoints. Server-side controls should be reviewed to ensure uploaded file directories are not web-executable. Monitor web server logs for POST requests to plugin upload handlers and any subsequent GET requests to recently uploaded files in wp-content directories as detection signals for exploitation attempts.