Answer in brief
CVE-2026-15760 records a Medium severity (CVSS 6.5) vulnerability in Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action. The current sources do not mark it as known exploited. The current feed maps Divi Essential/Divi Essentials (generic), Divi Essential/Divi Essentials (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Divi Essential/Divi Essentials (generic), Divi Essential/Divi Essentials (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Divi Essential/Divi Essentialsgeneric | >=0 <=5.8.1 | Not reported |
| Divi Essential/Divi Essentialsgeneric | 0 | Not reported |
Published upstream
Sep 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 19, 2026
The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call current_user_can() or otherwise enforce a capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).
Quoted source text, attributed separately from HOL analysis.