CVE-2026-5524: Divi Form Builder WordPress plugin allows unauthenticated arbitrary file upload via user-controlled acceptFileTypes, leading to RCE by uploading executable PHP extensions and accessing them in /wp-content/uploads/de_fb_uploads/.
CVE-2026-5524 is verified against divi-form-builder · wordpress affected versions: All versions up to and including 5.1.8 vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00252.
pruva-verify REPRO-2026-00252 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00252/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh The Divi Form Builder plugin for WordPress contains an arbitrary file upload vulnerability in do_image_upload() where the acceptFileTypes POST parameter is directly interpolated into a regex. Attackers can supply executable PHP extensions (e.g., .phtml, .phar, .php5, .php7) to bypass .htaccess protections that only block .php, resulting in remote code execution. On Nginx-based servers, .htaccess is ignored, making protection ineffective. Unauthenticated attackers can obtain a nonce from any public page containing a form and upload PHP files to /wp-content/uploads/de_fb_uploads/ for execution.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.