# Divi Form Builder With Material Design <= 8.4.2 - Unauthenticated Arbitrary File Upload via Form File Upload Field

- **ID:** WPSEC-2026-2442
- **Plugin:** Divi Form Builder With Material Design (`forms-for-divi`), https://wordpress.org/plugins/forms-for-divi/
- **Affected versions:** all versions before 8.5.0
- **Fixed in:** 8.5.0 (Update to 8.5.0 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-434
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/forms-for-divi
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2442/

## Description

The Divi Form Builder With Material Design plugin for WordPress is vulnerable to arbitrary file uploads via the form file upload field in all versions up to, and including, 8.4.2. This is due to missing file type, extension and MIME validation in the front-end form submission handler, which moved the client-supplied file into the wp-content/uploads/wpt_divi_forms_uploads directory with its original extension before the CSRF token or any field validation was checked. This makes it possible for unauthenticated attackers to upload arbitrary files, such as PHP scripts, to the affected site's server through any published form containing a file upload field. The stored file name gets a random 13-character prefix, so an attacker has to learn the file's location (for example from a notification email the form sends them) before remote code execution becomes possible.

## References

- https://wpsec.com/vuln/WPSEC-2026-2442/
- https://plugins.svn.wordpress.org/forms-for-divi/tags/8.5.0/
- https://wordpress.org/plugins/forms-for-divi/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2442/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.