On this page

Atomicorp WAF Rule 398130

Rule Summary

  • Rule ID: 398130
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: CVE-2026-5524 PHP-executable file upload via the Divi Form Builder de_fb_image_upload action (unauth upload RCE); scoped to the vulnerable action to avoid admin-ajax FPs; complements 382238 which blocks execution
  • Observed CWEs: None documented
  • Revision: 2
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Request filename
  • Rule action: deny
  • HTTP status: 403
  • Public tags: CVE-2026-5524, upload-rce
  • Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “CVE-2026-5524 PHP-executable file upload via the Divi Form Builder de_fb_image_upload action (unauth upload RCE); scoped to the vulnerable action to avoid admin-ajax FPs; complements 382238 which blocks execution” in the request filename. It evaluates during the request body phase and denies matching traffic with HTTP status 403.

CVEs Referenced by This Rule

The current ModSecurity rule metadata explicitly names the following CVEs. These references explain the rule author’s association; they do not claim that the rule is limited to these vulnerabilities or that this is an exhaustive coverage list.

CVE-2026-5524

The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin’s .htaccess protection which only blocks .php files specifically. Additionally, on Nginx-based servers, the .htaccess protection is completely ineffective as Nginx does not process .htaccess files. This makes it possible for unauthenticated attackers (who can obtain a nonce from any public page containing a form) to upload executable PHP files to the publicly accessible /wp-content/uploads/de_fb_uploads/ directory and achieve Remote Code Execution by accessing the uploaded file via HTTP. The vulnerability was partially patched in version 5.1.3.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.