Divi Form Builder With Material Design <= 8.4.2 - Unauthenticated Arbitrary File Upload via Form File Upload Field
- ID
- WPSEC-2026-2442
- Plugin
- Divi Form Builder With Material Design (forms-for-divi)
- Affected
- all versions before 8.5.0
- Remediation
- Update to 8.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-434
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- Divi Form Builder With Material Design on WPSec AttackSurface
- Fix released
- Published
Description
The Divi Form Builder With Material Design plugin for WordPress is vulnerable to arbitrary file uploads via the form file upload field in all versions up to, and including, 8.4.2. This is due to missing file type, extension and MIME validation in the front-end form submission handler, which moved the client-supplied file into the wp-content/uploads/wpt_divi_forms_uploads directory with its original extension before the CSRF token or any field validation was checked. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP scripts, to the affected site's server through any published form containing a file upload field. The stored file name gets a random 13-character prefix, so an attacker has to learn the file's location (for example from a notification email the form sends them) before remote code execution becomes possible.
References
- https://wpsec.com/vuln/WPSEC-2026-2442/
- https://plugins.svn.wordpress.org/forms-for-divi/tags/8.5.0/
- https://wordpress.org/plugins/forms-for-divi/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS