The Divi Form Builder plugin for WordPress contains an arbitrary file upload flaw that allows an unauthenticated attacker to upload executable PHP files. The flaw is located in the do_image_upload() function where the acceptFileTypes POST parameter is interpolated directly into a regular expression used for file‑type validation. Because this expression does not reject executable extensions such as .phtml, .phar, .php5, or .php7, a malicious file can be stored in the publicly accessible /wp-content/uploads/de_fb_uploads/ directory. When accessed via HTTP, the server executes the file with the privileges of the web server, giving the attacker full remote control. This issue is classified as CWE‑434. The vulnerability requires no authentication; any visitor to a public form can obtain the necessary nonce, craft a POST request with a malicious acceptFileTypes value, upload a PHP payload to and then trigger it by browsing to the file. Because the upload directory is publicly writable and executable, the flaw provides a direct path to compromise the hosting server, potentially affecting all stored community or corporate data and enabling further lateral movement.

All WordPress sites that use the Divi Form Builder plugin from Divi Engine with versions 5.1.8 or earlier are affected. The vulnerability exists in the plugin’s directory and uploads files under /wp-content/uploads/de_fb_uploads/ any web server that exposes that directory, including Apache (where .htaccess protection is limited to .php files only) and Nginx (where .htaccess files are ignored).

The CVSS score of 9.8 classifies this flaw as Critical. The EPSS score of < 1% indicates a very low but nonzero exploitation probability. The flaw does not require authentication; any internet‑reachable WordPress site with a public form is vulnerable. The attack path is straightforward: gather a form nonce, send a crafted POST request with a malicious acceptFileTypes value, upload the executable payload to the uploads directory, and access the file via remote code execution. Once PHP is executed, the attacker gains full control of the web server.