EUVD-2026-36271Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Fediverse Embeds ≤1.5.7
-
DeliveryBase64-encode internal target URL (e.g., IMDS or intranet)
-
ExploitGET /wp-json/ftf/media-proxy?url=<b64> anonymously
-
ExecutionPlugin calls wp_remote_get server-side
-
PersistResponse body echoed to attacker
-
ImpactHarvest credentials or internal data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target site must have the Fediverse Embeds WordPress plugin installed and active at version 1.5.7 or earlier, with the REST API reachable from the attacker (default for any public WordPress install). No authentication, no user interaction, no non-default configuration: the route ftf/media-proxy is registered with permission_callback => __return_true on plugin activation, and the broken $can_download_media flag means even URLs to non-fediverse hosts are fetched. Practical impact is gated only by what the WordPress server's outbound network can reach - sites with strict egress filtering or no access to cloud metadata/internal services still leak arbitrary public URLs but lose the high-value internal pivot. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N is consistent with the description: an anonymous network attacker can reach the REST endpoint and read sensitive responses (cloud IMDS, internal admin panels, intranet apps) with no user interaction, hence high confidentiality and no integrity or availability impact under the unchanged scope. The vulnerability is not on CISA KEV and no EPSS score was provided in the input, but the trigger is a single GET request with a base64 parameter, which makes it highly automatable and well within scripted mass-scan territory once the route name is known. The plugin appears to have a modest install base (it is a single-maintainer GitHub-hosted advisory rather than a wordpress.org headline plugin), which likely tempers real-world targeting versus a Tomcat- or WooCommerce-class issue - treat it as a real but niche priority, prioritized higher on any host inside an AWS/GCP/Azure VPC where IMDSv1 or internal services are reachable. |
| Exploit ScenarioDerived | An unauthenticated attacker issues GET /wp-json/ftf/media-proxy?url=<base64(http://169.254.169.254/latest/meta-data/iam/security-credentials/)> against any WordPress site running Fediverse Embeds 1.5.7 or earlier; the plugin decodes the URL, calls wp_remote_get server-side from the WordPress host, and returns the IAM credential response in the HTTP body. The same primitive works against intranet admin panels, Redis/Elasticsearch HTTP interfaces, and internal staging hosts reachable from the WordPress server. No public exploit identified at time of analysis, but the one-request shape makes weaponization trivial once the endpoint is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 11, 2026
Server-side request forgery in the Fediverse Embeds WordPress plugin before 1.5.8 lets any unauthenticated visitor coerce the WordPress host into issuing arbitrary outbound HTTP requests and returns the full response body to the caller, turning the site into a full-read open proxy. The flaw stems from the ftf/media-proxy REST route being registered with permission_callback => __return_true and a dead allowlist check whose result was never honored before wp_remote_get was invoked on a base64-decoded attacker-supplied URL. No public exploit identified at time of analysis, but the bug is trivial to weaponize against internal cloud metadata endpoints and intranet services from any reachable WordPress install.
RemediationAI
Vendor-released patch: upgrade Fediverse Embeds to version 1.5.8, which removes the vulnerable includes/Media_Proxy.php proxy path entirely (see commit 2f021faf4dadaccef67eda7b81a0b7ceaef450df and advisory GHSA-mpq6-hjh3-m543 at https://github.com/stefanbohacek/fediverse-embeds-wordpress-plugin/security/advisories/GHSA-mpq6-hjh3-m543). If an immediate upgrade is not possible, deactivate the plugin from wp-admin → Plugins, or block external requests to the REST route /wp-json/ftf/media-proxy at the web server or WAF layer - both will break embedded fediverse media rendering until the upgrade is applied. On cloud-hosted sites, also enforce IMDSv2 with hop-limit 1 and egress filtering from the WordPress instance so that any residual SSRF primitive cannot reach 169.254.169.254 or internal RFC1918 services; the trade-off is operational change to the instance metadata configuration but no functional impact on WordPress itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fediverse Embeds is a third-party WordPress plugin (vendor stefanbohacek) that renders ActivityPub/Mastodon posts inside WordPress content and ships a media proxy used to fetch remote images, video, and audio from fediverse hosts. The vulnerable component is includes/Media_Proxy.php, which registers a WP REST API route under the ftf namespace and calls WordPress's wp_remote_get HTTP client on a user-supplied URL. The root cause is CWE-918 (Server-Side Request Forgery): the code computes a $can_download_media boolean from a hardcoded allowlist (cdn.masto.host, pool.jortage.com, social-cdn.vivaldi.net, *.files.fedi.monster) and a /.well-known/nodeinfo probe, but never branches on that flag - the wp_remote_get($url) call executes unconditionally, and the response body is echoed back after only a MIME-type filter that does not restrict the destination host.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated REST route reachable over the network with a single GET (AV:N/AC:L/PR:N/UI:N); response body is returned to the caller giving high confidentiality, with no integrity or availability impact and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unauthenticated REST route ftf/media-proxy (includes/Media_Proxy.php) with permission_callback => __return_true that accepted a base64-encoded URL and forwarded it to wp_remote_get($url) without enforcing any allowlist. The plugin's source contained a comment block explicitly acknowledging that the request should be validated against allowed fediverse domains, but in 1.5.7 the validation only set a local $can_download_media flag that was never read. The full response body was echoed back to the caller, so this was a full-read SSRF / open proxy reachable by any anonymous visitor. This issue has been patched in version 1.5.8.
Articles & Coverage 1
Executive ViewAI
The Fediverse Embeds WordPress plugin before version 1.5.8 contains an unauthenticated server-side request forgery vulnerability that allows any website visitor to coerce your WordPress instance into making arbitrary HTTP requests to internal systems and returning full response bodies-effectively converting your web server into an open proxy. Organizations running this plugin face direct risk of credential exposure, unauthorized access to cloud metadata services, and lateral movement into internal networks. The flaw is trivial to exploit with zero barriers to entry, creating immediate organizational risk to any internet-facing WordPress deployment with this plugin installed.
Remove the plugin immediately-this is the only reliable control. If business requirements prevent removal, deploy Web Application Firewall rules to block all traffic to the /ftf/media-proxy endpoint; implement network-layer egress filtering to restrict outbound HTTP/HTTPS from WordPress servers to only approved internal destinations; disable WordPress REST API entirely if not actively required; enable detailed request logging on all outbound connections from affected servers for forensic analysis of potential compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB