Vulnerabilidades de Divi Engine
CVEs publicadas que afetam produtos de Divi Engine: 3 registro(s), com severidade, exploração e correções.
CVE-2026-5523
Alta · 8.8
CWE-639 09/07/2026
Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form
The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the update_user() function accepting a user ID parameter from form submissions without verifying that the authenticated user has permission to edit that specific user account, and the handle_register_submission() function only checking if any user is logged in rather than validating permissions for the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to change the email address and password of any user account, including administrators, resulting in complete account takeover.
CVE-2026-5524
Crítica · 9.8
CWE-434 02/07/2026
Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically. Additionally, on Nginx-based servers, the .htaccess protection is completely ineffective as Nginx does not process .htaccess files. This makes it possible for unauthenticated attackers (who can obtain a nonce from any public page containing a form) to upload executable PHP files to the publicly accessible /wp-content/uploads/de_fb_uploads/ directory and achieve Remote Code Execution by accessing the uploaded file via HTTP. The vulnerability was partially patched in version 5.1.3.
CVE-2026-5118
Crítica · 9.8
CWE-269 21/05/2026
Divi Form Builder <= 5.1.2 - Escalonamento de privilégio não autenticado via parâmetro role
O plugin Divi Form Builder para WordPress é vulnerável a escalonamento de privilégio nas versões até, e incluindo, 5.1.2. Isso ocorre porque o plugin aceita um parâmetro 'role' controlado pelo usuário a partir de dados POST durante o registro de usuário, sem validá-lo em relação à configuração default_user_role do formulário. Isso torna possível que atacantes não autenticados criem contas de administrador ao manipular o parâmetro role durante o registro.