EUVD-2026-83470
GHSA-hcxp-7h6p-263r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Remote low-complexity attack by an authenticated Subscriber (PR:L, no UI); confidentiality High because password hashes, session tokens, and stored credentials are readable; no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call current_user_can() or otherwise enforce a capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table - including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).
AnalysisAI
Sensitive information disclosure in the Divi Essential WordPress plugin through version 5.8.1 allows any authenticated user holding Subscriber-level access or above to enumerate every table in the site's WordPress database and read a caller-controlled number of rows from each, exposing usernames, emails, hashed passwords, session tokens, secret keys, and plugin-stored API credentials. The flaw is trivially reachable because the dnxte_get_database_tables and dnxte_get_database_data AJAX handlers only perform a nonce check when the 'nonce' POST parameter is supplied - omitting it skips the check entirely - and no current_user_can() capability enforcement exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Divi Essential plugin (version ≤5.8.1) installed and active on WordPress, plus an authenticated Subscriber-level-or-above account (PR:L) - practically unrestricted where open user registration is enabled, but a genuine barrier on sites that disallow self-registration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-priority information-disclosure flaw despite its moderate 6.5 CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is confirmed in the available intelligence - the only vendor-supplied reference is the Divi Essential changelog (https://www.divinext.com/divi-essential-changelog/), so site owners should check that changelog and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/61831b3e-4b2a-4fce-8fa2-818aa9991bb2?source=cve) for a fixed release and upgrade Divi Essential beyond 5.8.1 as soon as one is published; until then, treat every installed instance as vulnerable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today