Fediverse Embeds
Monthly
Server-Side Request Forgery in the Fediverse Embeds WordPress plugin before 1.5.8 allows unauthenticated remote attackers to make the WordPress server fetch arbitrary internal and private-network URLs via an unvalidated site-info endpoint. The nonce intended to gate access to this endpoint is inadvertently rendered into the HTML of any public page carrying a Fediverse embed, making the authentication bypass trivial for any site visitor. A publicly available exploit exists per WPScan; no confirmed active exploitation (KEV absent) but the attack is fully automatable per SSVC assessment.
Unauthenticated full-read SSRF in the Fediverse Embeds WordPress plugin (all versions before 1.5.8) exposes any internal or cloud-metadata URL reachable from the WordPress server's network to anonymous attackers via an unvalidated media-proxying endpoint. The endpoint also acts as an open proxy, returning the complete response body to the requester. A publicly available exploit has been published by WPScan, and the SSVC framework marks the vulnerability as automatable, though EPSS sits at just 0.13% (3rd percentile), indicating limited observed mass exploitation at time of analysis.
Server-Side Request Forgery in the Fediverse Embeds WordPress plugin before 1.5.8 allows unauthenticated remote attackers to make the WordPress server fetch arbitrary internal and private-network URLs via an unvalidated site-info endpoint. The nonce intended to gate access to this endpoint is inadvertently rendered into the HTML of any public page carrying a Fediverse embed, making the authentication bypass trivial for any site visitor. A publicly available exploit exists per WPScan; no confirmed active exploitation (KEV absent) but the attack is fully automatable per SSVC assessment.
Unauthenticated full-read SSRF in the Fediverse Embeds WordPress plugin (all versions before 1.5.8) exposes any internal or cloud-metadata URL reachable from the WordPress server's network to anonymous attackers via an unvalidated media-proxying endpoint. The endpoint also acts as an open proxy, returning the complete response body to the requester. A publicly available exploit has been published by WPScan, and the SSVC framework marks the vulnerability as automatable, though EPSS sits at just 0.13% (3rd percentile), indicating limited observed mass exploitation at time of analysis.