CVE-2026-14321
Received Received - Intake

Divi-Dash WordPress Plugin IP Spoofing Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-14321
EUVD
EUVD-2026-85020

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
divi dash to 1.0.7 (exc)
divi_dash divi_dash to 1.0.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Divi Dash WordPress plugin before version 1.0.7 has a flaw where it does not properly validate the source of client IP addresses used for rate limiting and banning. This allows unauthenticated attackers to spoof IP addresses to bypass rate limits, prevent specific IPs from being banned, and cause the plugin's stored options to grow without bound, leading to a denial of service condition.

Detection Guidance

Check the installed version of the divi-dash WordPress plugin. If it is below 1.0.7, the system is vulnerable. Review server logs for unusual rate limiting or banning activity, particularly involving spoofed IP addresses.

Impact Analysis

This vulnerability can allow attackers to bypass rate limits, prevent legitimate users from being banned, and cause the plugin to consume excessive server resources by growing stored options indefinitely. This may lead to degraded performance or complete service disruption for the WordPress site.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it primarily causes a denial of service through resource exhaustion rather than data exposure or unauthorized access. However, if the plugin is used in systems handling regulated data, the resulting service disruption could indirectly impact compliance by preventing timely access to required data or systems.

Mitigation Strategies

Update the divi-dash plugin to version 1.0.7 or later immediately. If an update is not available, consider disabling the plugin until a patch is released. Monitor server resources for abnormal growth in stored options.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14321. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart