The Divi theme contains a blind SSRF flaw caused by the function that retrieves a remote image URL. When the image_src parameter is supplied, the code uses a non‑safe HTTP client, allowing the application to reach arbitrary network locations. Although the response body is not returned, two oracles are available: a status oracle that can reveal if the target returned a 200 status, and a timing oracle that can infer the reachability of the target based on response time. These oracles enable an attacker to map internal networks and probe for sensitive services. The flaw is rated moderate in CVSS terms because it requires authenticated access but can still facilitate significant reconnaissance.

Elegant Themes’ Divi theme for WordPress, versions 4.0.0 through 4.27.6 inclusive. Any WordPress site installing one of these affected Divi releases is at risk. No patch is available for earlier releases, so only the 4.27.7 version or later contains the fix.

The CVSS score of 5.0 reflects the moderate impact of a blind SSRF that requires Contributor‑level or higher authentication. EPSS data is currently not published, implying limited public exploitation evidence. Because the vulnerability is not listed in the CISA KEV catalog, it does not meet the criteria of a widely exploited, known vulnerability. The most likely attack vector is an authenticated session—an attacker who has earned Contributor privileges can submit arbitrary image_src values to trigger the SSRF, using the status and timing oracles to infer sensitive information. Mitigation mainly depends on updating Divi or implementing compensating controls to restrict external requests or contributions.