CVE-2026-4361— Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
Quick assessment
Affected
Elegant Themes Divi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Divi 主题在 4.27.6 及之前所有版本中均存在服务端请求伪造（SSRF）漏洞。该漏洞的成因在于 函数使用了 而非 来获取远程图片 URL，而未将请求限制在私有或保留的 IP 地址范围之外。这使得拥有贡献者（Contributor）及以上权限的已认证攻击者能够从 Web 应用服务器发起对任意位置的 HTTP 请求。响应体不会返回给攻击者（即盲 SSRF），但存在两个“预言机”特征：状态预言机（根据目标是否返回 HTTP 200，返回的 URL 字符串会不同）和时序预言机（根据目标的可达
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-4361
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oembed_thumbnail_resolution()` function using `wp_remote_get()` instead of `wp_safe_remote_get()` to fetch a remote image URL, which does not restrict requests to private or reserved IP ranges. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application server. The response body is not returned to the attacker (blind SSRF), but two oracles exist: a status oracle (the returned URL string differs depending on whether the target responded with HTTP 200) and a timing oracle (response time varies by target reachability).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elegant Themes | Divi | 0 ~ 4.27.6 | - |
|
II. Public POCs for CVE-2026-4361
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-4361
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-4361 (1)
Vendor Pages for CVE-2026-4361 (2)
IV. Related Vulnerabilities
Same product: Divi
-
CVE-2026-3853
Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stor -
CVE-2026-3852
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-S -
CVE-2026-3850
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-S -
CVE-2026-3851
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-S -
CVE-2026-13712
Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media
Same vendor: Elegant Themes
-
CVE-2026-3853
Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stor -
CVE-2026-3852
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-S -
CVE-2026-3850
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-S -
CVE-2026-3851
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-S -
CVE-2024-5533
Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-S
Same weakness: CWE-918
-
CVE-2026-52769
YesWiki: Unauthenticated Server-Side Request Forgery via Act -
CVE-2026-86100
Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in U -
CVE-2026-17631
Langflow OSS is affected by server-side request forgery due -
CVE-2026-19301
Langflow is vulnerable to Server-Side Request Forgery due to -
CVE-2026-18905
IBM ContextForge MCP Gateway is affected by server-side requ
V. Comments for CVE-2026-4361
No comments yet