CVE-2026-4361 Details
Description
The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oembed_thumbnail_resolution()` function using `wp_remote_get()` instead of `wp_safe_remote_get()` to fetch a remote image URL, which does not restrict requests to private or reserved IP ranges. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application server. The response body is not returned to the attacker (blind SSRF), but two oracles exist: a status oracle (the returned URL string differs depending on whether the target responded with HTTP 200) and a timing oracle (response time varies by target reachability).
A server-side request forgery (SSRF) vulnerability has been identified in the Divi theme for WordPress, affecting all versions through 4.27.6. The vulnerability arises because the 'et_pb_set_video_oembed_thumbnail_resolution()' function uses 'wp_remote_get()' instead of 'wp_safe_remote_get()' to retrieve remote image URLs. This oversight allows authenticated attackers with Contributor-level access and above to send web requests to arbitrary locations from the web application server. Although the response body is not returned to the attacker, creating a blind SSRF, two oracles are available: a status oracle, which indicates whether a target responded with HTTP 200, and a timing oracle, which reveals response time variations based on target reachability.
Users are advised to update to version 4.27.7 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Elegant Themes Divi | <= 4.27.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 7, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |