CVE-2026-15760 in Divi Essential Plugin
Summary
by MITRE • 09/19/2026
The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call current_user_can() or otherwise enforce a capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The Divi Essential plugin for WordPress versions up to 5.8.1 contains a critical vulnerability classified as sensitive information exposure due to insufficient access control mechanisms within its AJAX handlers. Specifically, the functions dnxte_get_database_tables and dnxte_get_database_data fail to enforce proper authorization checks before executing database queries. This flaw allows authenticated attackers with low-privilege accounts, such as those holding Subscriber-level permissions or higher, to bypass intended security restrictions and interact directly with the underlying WordPress database structure. The vulnerability stems from a flawed implementation of nonce verification where the check is only performed if the nonce parameter is explicitly present in the POST request. By simply omitting this parameter, an attacker can trivially bypass the nonce validation mechanism entirely. Furthermore, the handlers do not invoke current_user_can or any equivalent capability checks to verify that the requesting user has sufficient privileges to access sensitive database information. This combination of weak authentication and missing authorization logic creates a significant security gap that compromises the integrity and confidentiality of the WordPress installation.
The operational impact of this vulnerability is severe as it enables unauthorized enumeration of all tables within the WordPress database schema. Attackers can not only list every table but also read up to a caller-controlled number of rows from any selected table. This capability exposes highly sensitive data including usernames, email addresses, and hashed passwords stored in the wp_users table. Additionally, attackers can access session tokens, secret keys, and other authentication-related metadata housed within the wp_usermeta table. The vulnerability also permits reading privileged settings, API keys, and credentials for third-party plugins stored in the wp_options table. Such exposure facilitates further attacks including account takeover via credential stuffing or brute force against exposed password hashes, session hijacking through stolen tokens, and privilege escalation by leveraging compromised administrative credentials or plugin-specific secrets.
From a technical classification perspective, this vulnerability aligns with CWE-284 Improper Access Control as the core issue lies in the failure to restrict access based on user roles and capabilities. It also relates closely to CWE-798 Use of Hard-coded Credentials if sensitive keys are exposed via wp_options, and CWE-359 Exposure of Private Information Through User Error or System Misconfiguration due to the lack of proper input validation and authorization checks in AJAX endpoints. In terms of attack vectors, this falls under MITRE ATT&CK technique T1078 Valid Accounts as it requires initial authentication but leverages insufficient privilege separation. The exploitation path corresponds to T1530 Data from Cloud Storage Objects or local equivalent data exfiltration techniques where structured data is systematically harvested for malicious purposes.
Mitigation strategies should prioritize immediate patching of the Divi Essential plugin to a version that resolves these access control flaws. Administrators must ensure that all WordPress plugins are updated regularly to incorporate security fixes provided by developers. In environments where updating is not immediately feasible, implementing Web Application Firewall rules can help block requests targeting specific AJAX endpoints associated with this vulnerability. Additionally, enforcing strict role-based access controls and auditing plugin code for proper use of current_user_can checks during development phases will prevent similar issues in future releases. Regular security audits focusing on authentication and authorization logic within custom or third-party plugins are essential to maintaining a robust defense posture against information disclosure attacks.