Divi Form Builder vulnerabilities

The Divi Form Builder plugin for WordPress up to version 5.1.8 is vulnerable to arbitrary file upload leading to remote code execution. The issue is due to insufficient file extension validation in the do_image_upload() function, where the acceptFileTypes POST parameter is directly interpolated into a regular expression. Attackers can upload files with .phtml, .phar, .php5, or .php7 extensions, bypassing .htaccess protection that only blocks .php files.

The Divi Form Builder plugin for WordPress up to version 5.1.2 allows privilege escalation. It accepts a user-controlled 'role' parameter from POST data during registration without validating it against the form's default_user_role setting, enabling unauthenticated attackers to create administrator accounts.

The Divi Form Builder plugin for WordPress up to version 5.1.8 has an authorization bypass vulnerability. The update_user() function accepts a user ID from form submissions without verifying permissions, and handle_register_submission() only checks if a user is logged in, not if they can edit the target account. This allows authenticated attackers with subscriber-level access or higher to change the email and password of any user, including administrators, leading to full account takeover.