Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action
mediumThe Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present an...
- CVSS:
- 6.5 (Wordfence)
- Affected:
- up to 5.8.1
- Fixed in:
- 5.9.0
- Disclosed:
- Sep 18, 2026