CVE-2026-4361: Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution() function using wpremoteget() instead of wpsaferemoteget() to fetch a remote image URL, which does not restrict requests to private or reserved IP ranges. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application server. The response body is not returned to the attacker (blind SSRF), but two oracles exist: a status oracle (the returned URL string differs depending on whether the target responded with HTTP 200) and a timing oracle (response time varies by target reachability).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue in a WordPress site?
An attacker needs an authenticated WordPress account with at least the Contributor role. Unauthenticated visitors are not described as able to exploit it.
What can an attacker learn or do through the SSRF?
The attacker can cause the web application server to make requests to arbitrary locations, including private or reserved IP ranges. The response body is not exposed, but HTTP 200-dependent behavior and response timing can reveal whether a target is reachable or responding.
Which Divi versions are affected?
All Divi versions through 4.27.6, inclusive, are affected. The referenced Divi changelog identifies version 4.27.7.
How can defenders limit exposure before updating?
Restrict Contributor-level and higher accounts to trusted users, since those roles can trigger the vulnerable request path. Review such accounts for unauthorized access and limit the application server's ability to reach internal, private, and reserved network destinations where possible.