A critical vulnerability in the divi-dash WordPress plugin allows unauthenticated attackers to bypass security controls and trigger a denial of service condition.

The plugin suffers from an uncontrolled resource consumption flaw (CWE-400) because it fails to validate the source of client IP addresses used for rate limiting. This allows any unauthenticated attacker to spoof arbitrary IP addresses to bypass security blocks and exhaust system resources.

The ability for unauthenticated attackers to bypass rate limiting and ban legitimate users poses a significant risk to service availability. With a CVSS score of 8.2, this vulnerability represents a high risk of service disruption, potentially leading to unauthorized denial of service and operational downtime for users relying on the plugin.

Immediate Action: Update the divi-dash plugin to version 1.0.7 or later to implement proper IP validation and resource management.

Proactive Monitoring: Review web server and application access logs for unusual patterns of rapid IP address rotation or repeated rate-limiting trigger events.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rate limiting rules configured to inspect X-Forwarded-For headers or other IP-related headers, providing a layer of protection until the update is applied.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitation and the potential for denial of service, organizations utilizing the divi-dash plugin must prioritize patching immediately. Administrators should verify their current version and apply the update to version 1.0.7 to remediate the underlying logic flaw and restore the integrity of the plugin security controls.