EUVD-2026-42512
GHSA-9jc6-q7qm-59qj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network endpoint with no complexity; C:L reflects readable response body only; I:N and A:N as no write or disruption capability exists.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated media-proxying endpoint, allowing anonymous users to make the site fetch arbitrary URLs, including internal and private-network addresses, and read back the response body. This results in a full-read Server-Side Request Forgery and open proxy.
AnalysisAI
Unauthenticated full-read SSRF in the Fediverse Embeds WordPress plugin (all versions before 1.5.8) exposes any internal or cloud-metadata URL reachable from the WordPress server's network to anonymous attackers via an unvalidated media-proxying endpoint. The endpoint also acts as an open proxy, returning the complete response body to the requester. A publicly available exploit has been published by WPScan, and the SSVC framework marks the vulnerability as automatable, though EPSS sits at just 0.13% (3rd percentile), indicating limited observed mass exploitation at time of analysis.
Technical ContextAI
The Fediverse Embeds plugin provides WordPress sites with rich embed functionality for federated social media content (ActivityPub/Fediverse). It ships a server-side media-proxying endpoint intended to relay remote media assets to the browser. The root cause is the complete absence of destination validation on user-supplied URLs passed to this endpoint - no allowlist, no blocklist, and no schema restriction are applied before the WordPress server issues the outbound HTTP request. This is consistent with CWE-918 (Server-Side Request Forgery) coupled with an open proxy pattern, though no CWE was formally assigned in the NVD entry. The CPE string cpe:2.3:a:unknown:fediverse_embeds:*:*:*:*:*:*:*:* covers all versions of the plugin below 1.5.8. Because the endpoint is unauthenticated and exposed on any WordPress installation with the plugin active, it can be triggered trivially from the internet.
RemediationAI
The primary fix is updating the Fediverse Embeds plugin to version 1.5.8 or later, which introduces proper destination validation on the media-proxying endpoint; this patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/2ac80164-03b7-4966-b022-833b4194de80/. If immediate patching is not feasible, deactivating or uninstalling the Fediverse Embeds plugin eliminates the attack surface entirely at the cost of losing Fediverse embed functionality. As a network-layer compensating control, configure egress firewall rules on the WordPress host to block outbound HTTP/HTTPS requests to RFC 1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16, including the AWS/GCP/Azure metadata endpoint 169.254.169.254); note this does not prevent SSRF against reachable external URLs but substantially reduces lateral-movement risk. For AWS-hosted instances, enforcing IMDSv2 (requiring session tokens for metadata access) neutralizes credential theft via SSRF against the instance metadata service without affecting plugin functionality.
More in Fediverse Embeds
View allShare
External POC / Exploit Code
Leaving vuln.today