CVE-2026-4361

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oembed_thumbnail_resolution()` function using `wp_remote_get()` instead of `wp_safe_remote_get()` to fetch a remote image URL, which does not restrict requests to private or reserved IP ranges. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application server. The response body is not returned to the attacker (blind SSRF), but two oracles exist: a status oracle (the returned URL string differs depending on whether the target responded with HTTP 200) and a timing oracle (response time varies by target reachability).

• CWE-918

• https://www.divichangelog.com/divi-update/divi-4/version-4-27-7
• https://www.elegantthemes.com/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f35c0de9-abed-4cbf-a28c-48f8133a1bad?source=cve

Published

Sep 5, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43583OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist…6.5
• CVE-2026-43584OpenClaw before 2026.4.10 contains an insufficient environme…8.8
• CVE-2026-43585OpenClaw before 2026.4.15 captures resolved bearer-auth conf…9.8
• CVE-2026-4359A compromised third party cloud server or man-in-the-middle …3.7
• CVE-2026-4360In the Tarfile.extract() function, the filter parameter is n…5.3
• CVE-2026-43606Observable Timing Discrepancy in the AMD Vitis Libraries ECD…8.5
• CVE-2026-43616Detect-It-Easy prior to 3.21 contains a path traversal vulne…7.8
• CVE-2026-43617Rsync version 3.4.2 and prior contain an authorization bypas…6.3
• CVE-2026-43618Rsync version 3.4.2 and prior contain an integer overflow vu…8.1
• CVE-2026-43619Rsync version 3.4.2 and prior contain symlink race condition…7.2
• CVE-2026-4362The ElementsKit Elementor Addons plugin for WordPress is vul…6.5
• CVE-2026-43620Rsync version 3.4.2 and prior contain a receiver-side out-of…5.5