EUVD-2026-36271Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated REST route reachable over the network with a single GET (AV:N/AC:L/PR:N/UI:N); response body is returned to the caller giving high confidentiality, with no integrity or availability impact and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unauthenticated REST route ftf/media-proxy (includes/Media_Proxy.php) with permission_callback => __return_true that accepted a base64-encoded URL and forwarded it to wp_remote_get($url) without enforcing any allowlist. The plugin's source contained a comment block explicitly acknowledging that the request should be validated against allowed fediverse domains, but in 1.5.7 the validation only set a local $can_download_media flag that was never read. The full response body was echoed back to the caller, so this was a full-read SSRF / open proxy reachable by any anonymous visitor. This issue has been patched in version 1.5.8.
Articles & Coverage 1
AnalysisAI
Server-side request forgery in the Fediverse Embeds WordPress plugin before 1.5.8 lets any unauthenticated visitor coerce the WordPress host into issuing arbitrary outbound HTTP requests and returns the full response body to the caller, turning the site into a full-read open proxy. The flaw stems from the ftf/media-proxy REST route being registered with permission_callback => __return_true and a dead allowlist check whose result was never honored before wp_remote_get was invoked on a base64-decoded attacker-supplied URL. No public exploit identified at time of analysis, but the bug is trivial to weaponize against internal cloud metadata endpoints and intranet services from any reachable WordPress install.
Technical ContextAI
Fediverse Embeds is a third-party WordPress plugin (vendor stefanbohacek) that renders ActivityPub/Mastodon posts inside WordPress content and ships a media proxy used to fetch remote images, video, and audio from fediverse hosts. The vulnerable component is includes/Media_Proxy.php, which registers a WP REST API route under the ftf namespace and calls WordPress's wp_remote_get HTTP client on a user-supplied URL. The root cause is CWE-918 (Server-Side Request Forgery): the code computes a $can_download_media boolean from a hardcoded allowlist (cdn.masto.host, pool.jortage.com, social-cdn.vivaldi.net, *.files.fedi.monster) and a /.well-known/nodeinfo probe, but never branches on that flag - the wp_remote_get($url) call executes unconditionally, and the response body is echoed back after only a MIME-type filter that does not restrict the destination host.
RemediationAI
Vendor-released patch: upgrade Fediverse Embeds to version 1.5.8, which removes the vulnerable includes/Media_Proxy.php proxy path entirely (see commit 2f021faf4dadaccef67eda7b81a0b7ceaef450df and advisory GHSA-mpq6-hjh3-m543 at https://github.com/stefanbohacek/fediverse-embeds-wordpress-plugin/security/advisories/GHSA-mpq6-hjh3-m543). If an immediate upgrade is not possible, deactivate the plugin from wp-admin → Plugins, or block external requests to the REST route /wp-json/ftf/media-proxy at the web server or WAF layer - both will break embedded fediverse media rendering until the upgrade is applied. On cloud-hosted sites, also enforce IMDSv2 with hop-limit 1 and egress filtering from the WordPress instance so that any residual SSRF primitive cannot reach 169.254.169.254 or internal RFC1918 services; the trade-off is operational change to the instance metadata configuration but no functional impact on WordPress itself.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today