---
id: CVE-2026-15760
title: >-
  The Divi Essential plugin for WordPress is vulnerable to sensitive information
  exposure in versions up to, and including, 5.8.1 via the
  dnxte_get_database_tables and dnxte_get_database_data AJAX actions
summary: >-
  The Divi Essential plugin for WordPress is vulnerable to sensitive information
  exposure in versions up to, and including, 5.8.1 via the
  dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The
  handlers  only conditionally …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: Divi Essential
product: Divi Essentials
affected:
  - divi_essentials <= 5.8.1
published: '2026-09-19'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T13:33:33.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15760'
references:
  - url: 'https://www.divinext.com/divi-essential-changelog/'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/61831b3e-4b2a-4fce-8fa2-818aa9991bb2?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.00221
epssPercentile: 0.11279
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-19T13:22:25.472847Z'
ingestedAt: '2026-09-19T02:56:32.977Z'
---

## Overview

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers  only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call current_user_can() or otherwise enforce a capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.