CVE-2026-4361: CWE-918 Server-Side Request Forgery (SSRF) in Elegant Themes Divi

CVE-2026-4361 is a Server-Side Request Forgery vulnerability in the Elegant Themes Divi WordPress theme affecting all versions up to and including 4.27.6. The vulnerability is due to the et_pb_set_video_oembed_thumbnail_resolution() function using wp_remote_get() instead of the safer wp_safe_remote_get(), which does not restrict requests to private or reserved IP ranges. This allows authenticated attackers with Contributor-level permissions or higher to cause the server to make HTTP requests to arbitrary internal or external network locations. Although the response body is not exposed (blind SSRF), attackers can use a status oracle based on returned URL differences and a timing oracle based on response times to infer information about the target. The CVSS v3.1 base score is 5.0, indicating medium severity.

Authenticated users with Contributor-level access or higher can exploit this vulnerability to make the web application server send HTTP requests to arbitrary locations, including internal network resources. This can potentially be used to probe internal services or perform other SSRF-related reconnaissance. The vulnerability does not expose response content directly but allows inference through status and timing oracles. There is no indication of direct data disclosure or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level user permissions and monitor for suspicious activity related to SSRF attempts. Vendors or site administrators should verify if an update to Divi beyond version 4.27.6 addresses this issue or if a patch is released. No official remediation level or patch links are currently provided.