Fediverse Embeds EUVD-2026-36270

The Fediverse Embeds plugin must be installed and active at a version prior to 1.5.9. At least one public (unauthenticated) WordPress page or post must contain a fediverse embed - the nonce ftf-fediverse-embeds-nonce is only present in page output when an embed is rendered, and without it the attacker cannot pass the nonce verification gate. No authentication, no account, and no elevated browser capability is required beyond the ability to load a public page. The primary limiting factor on impact is network reachability: if the WordPress server has no route to sensitive internal endpoints (internal APIs, metadata services, database management interfaces), the attacker can only cause the server to fetch arbitrary external URLs, which yields reconnaissance capability but not credential theft. Cloud-hosted instances without metadata endpoint restrictions or internal egress controls face substantially higher impact.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is consistent with the attack profile: network-accessible, zero-complexity exploitation, no privileges or user interaction required, with limited confidentiality impact. Attack complexity is genuinely low - the nonce is embedded in page HTML/JS and requires no brute force or guessing. The Confidentiality impact rating of Low (C:L) may understate cloud-hosted risk: SSRF against AWS IMDS (169.254.169.254), GCP metadata server, or Azure IMDS can yield IAM credentials enabling full account compromise, a severity not captured by the raw CVSS score. No EPSS data was provided, so exploitation probability cannot be quantified from that signal. The CVE is not listed in CISA KEV and no public proof-of-concept has been identified, suggesting no current opportunistic exploitation. On-premise deployments with strict egress controls face genuinely low real-world risk, while cloud-hosted WordPress instances with metadata endpoint access should treat this as higher priority than the CVSS score alone implies.

An attacker visits any public WordPress post that renders a fediverse embed, reads the ftf-fediverse-embeds-nonce value from the page's inline JavaScript, then sends a POST request to /wp-admin/admin-ajax.php with action=ftf_get_site_info, the extracted nonce, and site_url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ targeting the AWS Instance Metadata Service. The WordPress server fetches the URL and returns the response body, potentially exposing temporary IAM credentials that grant the attacker access to AWS resources associated with the EC2 instance role. No public proof-of-concept has been identified, but the technique follows well-documented SSRF patterns against cloud metadata services.