CVE-2026-14321

HIGHCVSS 8.2

Description

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.

Timeline

Published:September 23rd, 2026 6:17 AM

Last modified:September 23rd, 2026 6:13 PM

CVSS Scoring

CVSS v3: 8.2 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

CWE-400

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/6f56b800-c8f6-4cd9-a137-c05b718db201/

Source: NIST NVD · Data may lag official sources by up to one minute