CVE-2026-15760

Received Received - Intake

Sensitive Information Exposure in Divi Essential WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call current_user_can() or otherwise enforce a capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-15760

Affected Vendors & Products

Vendor	Product	Version / Range
divi_essential	divi_essential	to 5.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Divi Essential WordPress plugin up to version 5.8.1 has a flaw where two AJAX actions (dnxte_get_database_tables and dnxte_get_database_data) expose sensitive database information. The plugin fails to properly verify user permissions before allowing access to database tables and rows.

Detection Guidance

Check for unauthorized access to WordPress database tables via the Divi Essential plugin's AJAX actions. Monitor for requests to /wp-admin/admin-ajax.php with POST parameters dnxte_get_database_tables or dnxte_get_database_data without a valid nonce. Review server logs for suspicious queries targeting wp_users, wp_usermeta, or wp_options tables.

Impact Analysis

Attackers with Subscriber-level access or higher can exploit this to read sensitive data from the WordPress database, including usernames, emails, hashed passwords, session tokens, secret keys, and plugin-stored credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Update the Divi Essential plugin to the latest version immediately. If an update is unavailable, disable the plugin until a patch is released. Review user roles and remove unnecessary Subscriber-level accounts. Implement additional access controls for sensitive database queries.

Hi! I’m here to help you understand CVE-2026-15760. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70