CVE-2026-15760

Overview

The Divi Essential plugin for WordPress contains a vulnerability in its AJAX handlers that allows authenticated users to access sensitive database information. Due to missing authorization checks and bypassable security tokens, any user with Subscriber-level access can enumerate and read arbitrary database tables. This exposure includes critical data such as user credentials, session tokens, and site configuration settings.

Description

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call current_user_can() or otherwise enforce a capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).

Impact

This vulnerability compromises Confidentiality by allowing unauthorized access to the entire WordPress database. Impacted parties include site administrators and users whose hashed passwords, emails, and session tokens may be exposed. Successful exploitation can lead to full site takeover if administrative credentials or API keys are retrieved from the database.

Remediation

Update the Divi Essential plugin to version 5.8.2 or the latest available version immediately to patch the insecure AJAX handlers. Defenders should also audit database logs for unusual activity involving the dnxte_get_database_data action and consider rotating sensitive API keys if exposure is suspected.

Risk context

With a CVSS score of 6.5 (Medium) and an EPSS of 0.00221, the risk is significant for sites with open registration or multiple user tiers. While the EPSS indicates low current exploitation activity, the ease of access for any authenticated user elevates the internal threat profile.

Affected products

• Divi Essential (WordPress Plugin) <= 5.8.1