divi-dash EUVD-2026-85020

Requires that the divi-dash plugin (version below 1.0.7) is installed and its rate-limiting/banning feature is active, and that the site is reachable so the attacker can supply a forgeable client-IP source (e.g., a proxy/forwarded-for header the plugin trusts instead of the real connection address). No authentication, user interaction, or non-default toggle is described (PR:N/UI:N) - exploitation works against a default install of the affected plugin. Limiting factors are purely the plugin's small deployment footprint and the impact being denial of service / IP-ban manipulation rather than data disclosure (C:N) or code execution.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, base 8.2) rates this HIGH, driven almost entirely by A:H - the availability impact from an unbounded, ever-growing stored option (wp_options row) plus the ability to bypass rate limiting and ban legitimate addresses. However, exploitation-likelihood signals do not support treating this as an urgent, widespread threat: SSVC reports Exploitation=none (no observed exploitation), and there is no EPSS score, no CISA KEV listing, and no public POC identified in the provided data. SSVC does flag Automatable=yes and Technical Impact=partial, meaning that IF an exploit is developed it could be scripted at scale, which is consistent with the trivial AC:L/PR:N/UI:N vector (IP spoofing is typically as easy as setting an X-Forwarded-For header). The net picture is a genuinely low-complexity, unauthenticated flaw whose real-world priority is bounded by (a) the niche footprint of this specific plugin and (b) the impact being denial of service / integrity manipulation rather than data theft or code execution (C:N). No signals conflict materially; the main caveat is that A:H rests on the unbounded-growth DoS claim, which is plausible but not independently POC-verified.

An unauthenticated attacker sends repeated HTTP requests to the divi-dash-protected feature, each carrying a spoofed client IP (e.g., via a forgeable X-Forwarded-For header the plugin trusts). Because the plugin never validates the true source, the attacker rotates through arbitrary addresses to slip past rate limiting, ban legitimate/critical IPs, and drive continuous writes that inflate a stored WordPress option without bound until the site degrades or fails. No public exploit code is identified at time of analysis, though the technique is trivially scriptable (SSVC Automatable=yes).