EUVD-2026-71887
GHSA-pjxf-f8rh-3cjp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Contributor authentication required (PR:L); blind SSRF with oracle side-channels only yields C:L; scope changes to internal systems reachable from server (S:C).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the et_pb_set_video_oembed_thumbnail_resolution() function using wp_remote_get() instead of wp_safe_remote_get() to fetch a remote image URL, which does not restrict requests to private or reserved IP ranges. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application server. The response body is not returned to the attacker (blind SSRF), but two oracles exist: a status oracle (the returned URL string differs depending on whether the target responded with HTTP 200) and a timing oracle (response time varies by target reachability).
AnalysisAI
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level users to coerce the web server into making arbitrary outbound HTTP requests, including to private and reserved IP ranges unreachable from the public internet. The root cause is the use of WordPress's unrestricted wp_remote_get() instead of the network-safe wp_safe_remote_get() in the et_pb_set_video_oembed_thumbnail_resolution() function. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with at minimum Contributor-level role on the target site - unauthenticated exploitation is not possible per the CVSS PR:L vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.0 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N accurately reflects the constrained impact of a blind SSRF with only oracle channels. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Divi theme to version 4.27.7 or later, which replaces the unsafe `wp_remote_get()` call with `wp_safe_remote_get()` in `et_pb_set_video_oembed_thumbnail_resolution()`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitra
Stored cross-site scripting in the Divi WordPress theme (versions 5.0 through before 5.9.0) allows any contributor-role
Stored XSS in the Divi WordPress theme's Social Media Follow module allows authenticated Contributor-level users to inje
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.25.1 d
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all
Stored XSS in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) allows authenticated attackers with Con
DOM-based stored Cross-Site Scripting in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Con
Stored Cross-Site Scripting in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) enables authenticated
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today