Critical RCE Vulnerability in Divi Form Builder Plugin for WordPress

Divi Form Builder (<= 5.1.8) contains an unauthenticated arbitrary file upload vulnerability in do_image_upload() that allows attackers to upload executable PHP files (e.g., .phtml, .phar) and achieve remote code execution by bypassing .htaccess protections; the issue carries a CVSS 9.8, a partial fix in 5.1.3 is incomplete, and administrators (especially on Nginx) are advised to update beyond 5.1.8 and apply server-level protections — no proof-of-concept or active exploitation reported.