CVE-2026-15760 is a missing authorization vulnerability (CWE-862) in the Divi Essential WordPress plugin (up to version 5.8.1). The vulnerability arises because the AJAX handlers for dnxte_get_database_tables and dnxte_get_database_data only conditionally verify a nonce when the 'nonce' POST parameter is present, which can be bypassed by omitting the parameter. Additionally, the handlers do not enforce capability checks via current_user_can() or similar mechanisms. As a result, authenticated users with Subscriber-level privileges or higher can enumerate all WordPress database tables and read a caller-controlled number of rows from any table, including sensitive tables such as wp_users, wp_usermeta, and wp_options, exposing usernames, emails, hashed passwords, session tokens, secret keys, API keys, and other privileged data.

An attacker with low-level authenticated access can access sensitive information stored in the WordPress database, including user credentials and secret keys. This exposure can lead to further compromise of the WordPress site or associated systems. The vulnerability does not affect unauthenticated users and does not allow modification or denial of service, but the confidentiality impact is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor updates closely for a patch release.