blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-14321

HIGH 8.2 CVSS 3.1
Published
September 23, 2026
Last modified
September 23, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-400
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Description

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.

Affected products and versions

  • Unknown divi-dash — Before 1.0.7

References

  • wpscan.com https://wpscan.com/vulnerability/6f56b800-c8f6-4cd9-a137-c05b718db201/
  • nvd.nist.gov Official NVD record