漏洞速览
- 漏洞编号：
CVE-2026-5524 - 风险评分：
9.8（严重） - 首次披露：2026-07-01
- 最近更新：2026-07-02
- 软件类型：插件
- 软件标识：
divi-form-builder - 受影响版本：<= 5.1.8
- 修复版本：5.1.9
- 是否已修复：是
漏洞详情
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the doimageupload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin’s .htaccess protection which only blocks .php files specifically. Additionally, on Nginx-based servers, the .htaccess protection is completely ineffective as Nginx does not process .htaccess files. This makes it possible for unauthenticated attackers (who can obtain a nonce from any public page containing a form) to upload executable PHP files to the publicly accessible /wp-content/uploads/defbuploads/ directory and achieve Remote Code Execution by accessing the uploaded file via HTTP. The vulnerability was partially patched in version 5.1.3.
影响与风险
- 漏洞类型：Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via ‘acceptFileTypes’ Parameter
- 风险说明：漏洞可能被利用以执行未授权操作，建议按官方修复方案立即升级并复核安全配置。
- 研究人员：0xd4rk5id3 – EnvoraSec
修复建议
- 按官方建议执行修复：更新至 5.1.9 或更高已修复版本。
- 复核
administrator/shop manager等高权限账号与角色授权。 - 排查近期插件安装/配置变更记录，确认无异常写入。
- 建议配合 WAF 与登录审计，持续观察可疑请求。
评论0 注意：评论区不审核也不处理售后问题！如有售后问题请前往用户中心提交工单以详细说明!