CVE-2026-4361: Divi WordPress Theme SSRF Vulnerability

CVE-2026-4361 Overview

The Divi theme for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability affecting all versions up to and including 4.27.6. The flaw resides in the et_pb_set_video_oembed_thumbnail_resolution() function, which calls wp_remote_get() instead of the safer wp_safe_remote_get() when fetching remote image URLs. Authenticated attackers with Contributor-level access or above can issue web requests to arbitrary destinations from the WordPress server, including private and reserved IP ranges. While the response body is not returned to the attacker, status and timing oracles allow inference about internal network resources.

Critical Impact
Authenticated Contributor-level users can perform blind SSRF against internal network services, enabling reconnaissance of private IP ranges and cloud metadata endpoints from the WordPress host.

Affected Products

Elegant Themes Divi theme for WordPress, versions up to and including 4.27.6
Divi Builder plugin bundled with vulnerable Divi releases
WordPress installations using the vulnerable et_pb_set_video_oembed_thumbnail_resolution() function

Discovery Timeline

2026-09-05 - CVE-2026-4361 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-4361

Vulnerability Analysis

The vulnerability is classified under CWE-918: Server-Side Request Forgery. The Divi theme's video oEmbed thumbnail resolution feature accepts a user-supplied URL and fetches remote content on the server side. Because the theme uses WordPress's wp_remote_get() API instead of wp_safe_remote_get(), no filtering occurs against private, loopback, or link-local IP address ranges.

An attacker with Contributor privileges can supply URLs that target internal services such as 127.0.0.1, 169.254.169.254 cloud metadata endpoints, or RFC1918 addresses. Although the HTTP response body is not returned to the requester (blind SSRF), two side channels leak information. A status oracle reveals whether the target returned HTTP 200 through variations in the returned URL string. A timing oracle exposes reachability based on response latency differences.

Root Cause

The root cause is the direct use of wp_remote_get() in the et_pb_set_video_oembed_thumbnail_resolution() function without URL validation. WordPress provides wp_safe_remote_get() specifically to block requests to non-public IP ranges, but this wrapper was not invoked. No allowlist of external oEmbed providers restricts the destination host.

Attack Vector

Exploitation requires an authenticated session at Contributor role or higher. The attacker triggers the vulnerable function by submitting a video URL through the Divi Builder interface. The server issues an HTTP GET request to the attacker-controlled destination and returns a modified URL string reflecting the response status. By iterating targets and measuring both string differences and response times, attackers enumerate internal services and cloud metadata endpoints. Refer to the Wordfence Vulnerability Analysis for exploitation details.

Detection Methods for CVE-2026-4361

Indicators of Compromise

Outbound HTTP requests from the WordPress server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8)
Outbound requests to cloud instance metadata endpoints such as 169.254.169.254
Repeated Contributor-account activity invoking Divi Builder video/oEmbed functionality
Anomalous access patterns targeting et_pb_set_video_oembed_thumbnail_resolution or related AJAX endpoints

Detection Strategies

Monitor WordPress access logs for authenticated admin-ajax.php requests originating from Contributor-level accounts targeting Divi oEmbed actions
Correlate outbound network flows from the web server against internal IP allowlists to identify SSRF probing
Alert on latency-based enumeration patterns where the same account issues sequential oEmbed requests with varying hosts

Monitoring Recommendations

Enable WordPress audit logging for user role assignments and content submission activity
Deploy egress filtering at the network layer to log and alert on WordPress server connections to RFC1918, loopback, and link-local addresses
Review Contributor and Author account provisioning to identify unexpected or dormant accounts that may have been compromised

How to Mitigate CVE-2026-4361

Immediate Actions Required

Update the Divi theme to version 4.27.7 or later, which replaces wp_remote_get() with wp_safe_remote_get() in the affected function
Audit all WordPress accounts with Contributor role or higher and remove unnecessary privileges
Restrict outbound traffic from the WordPress host to prevent access to internal services and cloud metadata endpoints

Patch Information

Elegant Themes released Divi version 4.27.7 addressing this vulnerability. Full changelog details are available at the Divi 4.27.7 Update Details page. Administrators should apply the update through the WordPress dashboard or download the patched theme directly from Elegant Themes.

Workarounds

Disable the Divi Builder video module for Contributor-level users until the patch is applied
Implement network-layer egress filtering to block WordPress server requests to private IP ranges and 169.254.169.254
Temporarily restrict Contributor account creation and demote existing accounts that do not require content submission privileges

bash

# Example egress filtering with iptables to block SSRF to internal ranges
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.0.0/16 -j REJECT