Executive brief
The Divi WordPress theme is used by hundreds of thousands of web designers to build and manage websites through a visual interface. A vulnerability in the video thumbnail processing function allows authenticated users with Contributor-level access to make web requests from the server to internal or external systems without proper validation. While attackers cannot see direct response data, they can infer results through response timing and HTTP status codes, potentially discovering internal infrastructure or testing connectivity to restricted systems.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the `et_pb_set_video_oembed_thumbnail_resolution()` function due to unsafe use of `wp_remote_get()` instead of `wp_safe_remote_get()` when fetching remote image URLs. The function does not restrict requests to private or reserved IP ranges, allowing authenticated attackers (Contributor level and above) to probe arbitrary network endpoints. This is a blind SSRF: the response body is not returned to the attacker, but two information leakage vectors exist—a status oracle (HTTP 200 responses produce different URL strings) and a timing oracle (response latency varies by target reachability). The vulnerability affects all versions up to 4.27.6; a patch is available in version 4.27.7 and later.
Affected products
- Elegant Themes Divi up to 4.27.6
Timeline
- 2026-09-05: disclosed
- 2026: patched: Fixed in version 4.27.7