CVE-2026-15760: Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action

Q: Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. No administrative capability is required.

Q: What access does an attacker need to obtain the exposed data?

The attacker needs a valid authenticated WordPress account and the ability to invoke the affected AJAX actions. The nonce check can be bypassed by omitting the nonce POST parameter.

Q: What information could be exposed?

An attacker can enumerate all WordPress database tables and read a caller-controlled number of rows from any table. This can include usernames, email addresses, password hashes, user metadata such as session tokens and secret keys, and settings or credentials stored in wp_options by WordPress or other plugins.

Q: How can I tell whether my site is affected?

Sites using the Divi Essential WordPress plugin at version 5.8.1 or earlier are affected according to the available information. The issue concerns the dnxte_get_database_tables and dnxte_get_database_data AJAX actions.

Published Sep 19, 2026

Updated

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxtegetdatabasetables and dnxtegetdatabasedata AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call currentusercan() or otherwise enforce a capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wpusers (usernames, emails, hashed passwords), wpusermeta (session tokens, secret keys), and wpoptions (privileged settings, API keys, credentials stored by other plugins).

Affected Software

1 affected component

WordPress plugin Divi Essential<=5.8.1

Event History

Sep 19, 2026

CVE Published

via MITRE·02:27 AM

Data Sourced

via MITRE·02:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. No administrative capability is required.

What access does an attacker need to obtain the exposed data?

The attacker needs a valid authenticated WordPress account and the ability to invoke the affected AJAX actions. The nonce check can be bypassed by omitting the nonce POST parameter.

What information could be exposed?

An attacker can enumerate all WordPress database tables and read a caller-controlled number of rows from any table. This can include usernames, email addresses, password hashes, user metadata such as session tokens and secret keys, and settings or credentials stored in wp_options by WordPress or other plugins.

How can I tell whether my site is affected?

Sites using the Divi Essential WordPress plugin at version 5.8.1 or earlier are affected according to the available information. The issue concerns the dnxte_get_database_tables and dnxte_get_database_data AJAX actions.

CVE-2026-15760: Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to obtain the exposed data?

What information could be exposed?

How can I tell whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to obtain the exposed data?

What information could be exposed?

How can I tell whether my site is affected?