Divi Form Builder

Divi Form Builder has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 3 are fixed as of August 2026. Their average CVSS score is 9.5, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 1 high. 2026 was the busiest year with 3 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (33%). Other recurring categories include Improper Privilege Management, Unrestricted Upload Of File With Dangerous Type.

Every one of the 3 issues recorded for Divi Form Builder has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by 0xd4rk5id3.

Strategic Overview

Avg CVSSCritical

9.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Divi Form Builder vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-5524

Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter

Read the full analysis

Vulnerability Records

3 records


2026-07-08 00:00	Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form Divi Form Builder <= 5.1.8	`CVE-2026-5523`	8.8 High	0xd4rk5id3	Yes
2026-07-01 00:00	Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter Divi Form Builder <= 5.1.8	`CVE-2026-5524`	9.8 Critical	0xd4rk5id3	Yes
2026-05-20 00:00	Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role' Divi Form Builder <= 5.1.2	`CVE-2026-5118`	9.8 Critical	0xd4rk5id3	Yes

Showing 1–3 of 3 reports