Divi Essentials
Monthly
Sensitive information disclosure in the Divi Essential WordPress plugin through version 5.8.1 allows any authenticated user holding Subscriber-level access or above to enumerate every table in the site's WordPress database and read a caller-controlled number of rows from each, exposing usernames, emails, hashed passwords, session tokens, secret keys, and plugin-stored API credentials. The flaw is trivially reachable because the dnxte_get_database_tables and dnxte_get_database_data AJAX handlers only perform a nonce check when the 'nonce' POST parameter is supplied - omitting it skips the check entirely - and no current_user_can() capability enforcement exists. Authentication requirements are confirmed as low-privileged (CVSS PR:L) rather than unauthenticated, so the practical attack surface depends on whether the site allows open user self-registration; no public exploit code was identified at time of analysis, and the impact is confidentiality-only with no modification of data or loss of availability.
Sensitive information disclosure in the Divi Essential WordPress plugin through version 5.8.1 allows any authenticated user holding Subscriber-level access or above to enumerate every table in the site's WordPress database and read a caller-controlled number of rows from each, exposing usernames, emails, hashed passwords, session tokens, secret keys, and plugin-stored API credentials. The flaw is trivially reachable because the dnxte_get_database_tables and dnxte_get_database_data AJAX handlers only perform a nonce check when the 'nonce' POST parameter is supplied - omitting it skips the check entirely - and no current_user_can() capability enforcement exists. Authentication requirements are confirmed as low-privileged (CVSS PR:L) rather than unauthenticated, so the practical attack surface depends on whether the site allows open user self-registration; no public exploit code was identified at time of analysis, and the impact is confidentiality-only with no modification of data or loss of availability.