Divi Essentials <= 5.8.1 — Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Divi Essentials.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 5.9.0, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Divi Essentials to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to 0xd4rk5id3.

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call current_user_can() or otherwise enforce a capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Sep 18, 2026

   CVE published

   Severity medium, CVSS 6.5

2. Nov 13, 2026

   Record last updated