{
 "id": "WPSEC-2026-2442",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2442/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2442/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2442/index.md",
 "title": "Divi Form Builder With Material Design <= 8.4.2 - Unauthenticated Arbitrary File Upload via Form File Upload Field",
 "description": "The Divi Form Builder With Material Design plugin for WordPress is vulnerable to arbitrary file uploads via the form file upload field in all versions up to, and including, 8.4.2. This is due to missing file type, extension and MIME validation in the front-end form submission handler, which moved the client-supplied file into the wp-content/uploads/wpt_divi_forms_uploads directory with its original extension before the CSRF token or any field validation was checked. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP scripts, to the affected site's server through any published form containing a file upload field. The stored file name gets a random 13-character prefix, so an attacker has to learn the file's location (for example from a notification email the form sends them) before remote code execution becomes possible.",
 "plugin": {
  "slug": "forms-for-divi",
  "name": "Divi Form Builder With Material Design",
  "full_name": "Divi Form Builder With Material Design",
  "wordpress_org": "https://wordpress.org/plugins/forms-for-divi/",
  "advisories_url": "https://wpsec.com/vuln/plugin/forms-for-divi/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/forms-for-divi"
 },
 "type": "UPLOAD",
 "cwe": [
  "CWE-434"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.5.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.5.0",
 "remediation": "Update to 8.5.0 or later.",
 "fix_released": "2026-11-03T04:31:39+00:00",
 "published": "2026-11-04T04:41:49+00:00",
 "updated": "2026-11-03T13:23:26.738525+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2442/",
  "https://plugins.svn.wordpress.org/forms-for-divi/tags/8.5.0/",
  "https://wordpress.org/plugins/forms-for-divi/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/forms-for-divi",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}