Description

The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-23T06:17:00.850Z",
  "pubdate": "2026-09-23T06:17:00.850Z",
  "executiveSummary": "The divi-dash WordPress plugin, in versions prior to 1.0.7, contains a critical vulnerability stemming from improper validation of client IP address sources. This flaw allows unauthenticated remote attackers to manipulate HTTP headers, such as X-Forwarded-For, to spoof arbitrary IP addresses.\nBy bypassing the plugin's rate-limiting and banning mechanisms, an attacker can effectively weaponize the security feature against legitimate users or the system itself. The ability to inject arbitrary IP addresses into the plugin’s internal tracking mechanism leads to an uncontrolled growth of the associated WordPress stored option. This results in a Denial-of-Service (DoS) condition, potentially exhausting database resources or causing system instability. The vulnerability is highly accessible as it requires no authentication or specific privileges, making it a significant risk for WordPress installations utilizing this plugin for traffic control.",
  "technicalDetails": "The root cause of this vulnerability lies in the plugin's reliance on untrusted HTTP request headers to determine the originating IP address of a client. Specifically, the implementation fails to verify whether the provided IP address is derived from a direct connection or spoofed via headers like 'X-Forwarded-For' or 'X-Real-IP' without adequate sanitization or proxy trust verification.\nThe attack flow begins when an unauthenticated attacker sends crafted HTTP requests to the target server. By injecting arbitrary IP addresses into the aforementioned headers, the attacker forces the divi-dash plugin to associate requests with the spoofed identity. Because the plugin performs rate limiting and banning based on these unverified sources, an attacker can spoof the IP address of legitimate users or administrators, causing them to be erroneously banned from the feature or service.\nFurthermore, the plugin stores these tracked IP addresses within a WordPress database option. Since the application does not implement bounds checking or aging mechanisms on this stored data, an attacker can continuously inject unique, spoofed IP addresses. Each request forces the plugin to append a new entry to the database option, leading to an unbounded growth of the serialized array. Eventually, this memory and storage pressure on the WordPress options table can lead to significant database performance degradation, high memory consumption during serialization and deserialization cycles, and ultimately, a system-wide Denial-of-Service (DoS) condition.\nThis vulnerability is classified as an authorization and resource management failure. It affects versions prior to 1.0.7 and requires only network connectivity to the target WordPress instance. There are no authentication or elevated privilege requirements, allowing any remote user to initiate the exploit. The impact is twofold: immediate disruption of legitimate service access through malicious banning, and secondary infrastructure compromise through database bloat."
}