EUVD-2026-42513
GHSA-9x4j-8g3j-786h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint, nonce exposed publicly making complexity low and auth effectively none; metadata-only response caps confidentiality at Low with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users (the gating nonce is exposed on public pages carrying an embed) to make the site request internal and private-network URLs and read back the parsed page metadata. This is a Server-Side Request Forgery.
AnalysisAI
Server-Side Request Forgery in the Fediverse Embeds WordPress plugin before 1.5.8 allows unauthenticated remote attackers to make the WordPress server fetch arbitrary internal and private-network URLs via an unvalidated site-info endpoint. The nonce intended to gate access to this endpoint is inadvertently rendered into the HTML of any public page carrying a Fediverse embed, making the authentication bypass trivial for any site visitor. A publicly available exploit exists per WPScan; no confirmed active exploitation (KEV absent) but the attack is fully automatable per SSVC assessment.
Technical ContextAI
Fediverse Embeds is a WordPress plugin (CPE: cpe:2.3:a:unknown:fediverse_embeds:*:*:*:*:*:*:*:*) that exposes a server-side site-info endpoint responsible for fetching and parsing metadata from remote URLs to support embedding of Fediverse content such as Mastodon posts. The SSRF arises because this endpoint performs outbound HTTP requests on behalf of the requesting client without validating whether the supplied destination is a public internet resource or a private, loopback, or link-local address. The intended guard - a nonce token - is undermined by the fact that it is emitted into the HTML of any public page that renders an embed, making it readable by unauthenticated visitors. No CWE is assigned in the NVD entry; the root cause maps directly to CWE-918 (Server-Side Request Forgery), specifically the failure to enforce a destination allowlist or reject RFC-1918, loopback, and link-local targets on the server-side HTTP client.
RemediationAI
Update the Fediverse Embeds plugin to version 1.5.8 or later, which is confirmed as the patched release per the vendor advisory documented by WPScan at https://wpscan.com/vulnerability/460a996f-e27d-47e8-9d68-9e6be93100c0/. If immediate upgrade is not feasible, disable the plugin entirely - this eliminates the vulnerable site-info endpoint at the cost of removing all Fediverse embed functionality until the patch is applied. As a network-layer compensating control, configure outbound egress firewall rules on the WordPress host to deny connections to RFC-1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16); this blocks the most dangerous exploitation paths (cloud IMDS, internal services) without removing embed functionality, though it does not patch the underlying vulnerability. On AWS, enforce IMDSv2 (requiring a PUT-based token flow) to prevent unauthenticated SSRF from reaching instance metadata, as IMDSv1 is trivially reachable via any SSRF primitive; switching to IMDSv2 is low-risk and strongly recommended regardless of this CVE.
More in Fediverse Embeds
View allShare
External POC / Exploit Code
Leaving vuln.today