CVE-2026-14321

HighCVSS 8.2/10Last modified Sep 23, 2026

Description

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-143225.3The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method o CVE-2026-143237.5The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to,CVE-2026-143246.5RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.CVE-2026-143253.5The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using i CVE-2026-143263.8The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing CVE-2026-143277.5The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' par CVE-2026-143288.8The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in al CVE-2026-14334.8uniFLOW Universal Login Manager (ULM) Standalone contains an information disclosure vulnerability that may allow an authenticated administra CVE-2026-143305.5Multiple unbounded alloca() calls in the PulseAudio protocol server.CVE-2026-143316.1The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription CVE-2026-143325.4The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on o CVE-2026-143337.5The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename