CVE-2026-15760: Divi Essential Information Disclosure Flaw

CVE-2026-15760 Overview

The Divi Essential plugin for WordPress contains a missing authorization vulnerability [CWE-862] affecting all versions up to and including 5.8.1. The flaw resides in the dnxte_get_database_tables and dnxte_get_database_data AJAX handlers. These handlers only conditionally verify a nonce and never call current_user_can() to enforce a capability check. Authenticated attackers with Subscriber-level access can enumerate every table in the WordPress database and read arbitrary rows from any table, including wp_users, wp_usermeta, and wp_options.

Critical Impact
Low-privileged authenticated users can exfiltrate usernames, email addresses, hashed passwords, session tokens, secret keys, and API credentials stored across the WordPress database.

Affected Products

Divi Essential plugin for WordPress, versions up to and including 5.8.1
WordPress sites with Subscriber-level or higher user registration enabled
Sites using Divi Essential AJAX-driven database features

Discovery Timeline

2026-09-19 - CVE-2026-15760 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-15760

Vulnerability Analysis

The Divi Essential plugin registers two AJAX actions, dnxte_get_database_tables and dnxte_get_database_data, intended to expose database metadata to authorized users. Both handlers fail to enforce proper authorization. The nonce verification runs only when the nonce POST parameter is present in the request. An attacker can bypass the check by simply omitting that parameter from the request body.

Neither handler calls current_user_can() or performs any capability-based access control. Any authenticated session, including Subscriber accounts created through open registration, can invoke both endpoints. The dnxte_get_database_data handler additionally accepts a caller-controlled row count, allowing bulk extraction of arbitrary tables in a single request.

Root Cause

The root cause is missing authorization [CWE-862] combined with conditional nonce validation. The plugin developers assumed nonce presence would gate access, but the check is skipped entirely when the parameter is absent. No capability check enforces role-based restrictions on the AJAX endpoints. This design allows the lowest-privileged authenticated role to reach code paths intended for administrators.

Attack Vector

An attacker registers or logs in to a Subscriber account on the target WordPress site. The attacker sends a POST request to wp-admin/admin-ajax.php with action=dnxte_get_database_tables and no nonce parameter. The response returns a full enumeration of database tables. The attacker then issues subsequent requests to dnxte_get_database_data specifying the target table and a large row count. Sensitive data exposed includes wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, and credentials stored by other plugins).

Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-15760

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=dnxte_get_database_tables or action=dnxte_get_database_data originating from Subscriber-level sessions.
Requests to these AJAX actions missing the nonce parameter entirely.
Anomalously large response bodies from admin-ajax.php correlated with the two Divi Essential actions.
New Subscriber account registrations followed shortly by AJAX requests to the affected handlers.

Detection Strategies

Inspect web server access logs for the two AJAX action names and flag requests from non-administrator sessions.
Deploy a Web Application Firewall (WAF) rule that blocks requests to these actions when originating from low-privileged roles.
Correlate authentication events with subsequent AJAX activity to identify credential harvesting behavior.

Monitoring Recommendations

Monitor for unexpected reads of wp_users, wp_usermeta, and wp_options at the database layer.
Alert on password reset, credential rotation, or session token invalidation events that follow AJAX enumeration attempts.
Track outbound data volume from admin-ajax.php responses to detect bulk exfiltration.

How to Mitigate CVE-2026-15760

Immediate Actions Required

Update the Divi Essential plugin to a version later than 5.8.1 as soon as the vendor releases a patched build. Consult the Divi Essential Changelog for current release information.
Disable open user registration on affected WordPress sites until the plugin is patched.
Rotate all administrator passwords, API keys, and secrets stored in wp_options if the site permitted Subscriber registration prior to patching.
Invalidate active sessions by rotating wp_usermeta session tokens and force re-authentication.

Patch Information

Monitor the Divi Essential Changelog for the security release that addresses the missing authorization and conditional nonce checks in the dnxte_get_database_tables and dnxte_get_database_data handlers. The fix should enforce current_user_can() with an administrator capability and require an unconditional nonce verification.

Workarounds

Temporarily deactivate the Divi Essential plugin until an upstream fix is available.
Add a WAF rule that blocks POST requests to /wp-admin/admin-ajax.php where the action parameter matches dnxte_get_database_tables or dnxte_get_database_data.
Restrict access to /wp-admin/admin-ajax.php for Subscriber-level users via a mu-plugin that intercepts the two actions and calls wp_die() when the caller lacks the manage_options capability.

bash

# Example WAF rule (ModSecurity syntax) to block the vulnerable AJAX actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026015760,\
   msg:'Block Divi Essential CVE-2026-15760 AJAX actions'"
  SecRule ARGS:action "@rx ^dnxte_get_database_(tables|data)$" "t:lowercase"