Server-Side Request Forgery in Divi Theme by Elegant Themes

CVE-2026-4361

What is CVE-2026-4361?

The Divi theme developed by Elegant Themes is susceptible to a server-side request forgery vulnerability due to improper handling of remote image fetching. Specifically, the function et_pb_set_video_oembed_thumbnail_resolution() utilizes wp_remote_get() instead of the more secure wp_safe_remote_get(), allowing authenticated users with Contributor-level access and above to send requests to arbitrary locations from the server. Although the response body is not returned to the attacker (resulting in a blind SSRF), two indirect indicators can reveal information about the target: a status oracle, which provides different URL responses based on the HTTP status, and a timing oracle, which varies in response time based on the target’s availability.

References