Executive brief
EmbedPress is a WordPress plugin that allows embedding third-party content into WordPress sites. The plugin fails to properly validate user-supplied URLs before fetching them from the server, allowing unauthenticated attackers to force the WordPress site to make HTTP requests to internal systems and cloud metadata services. This could expose sensitive configuration data or enable attackers to interact with internal infrastructure.
Technical details
The vulnerability is a blind Server-Side Request Forgery (SSRF) in EmbedPress versions before 4.6.1. The plugin accepts user-supplied URLs via unauthenticated REST API endpoints and admin-ajax.php without proper validation, then fetches these URLs using WordPress's wp_safe_remote_get function. While WordPress core blocks RFC 1918 private ranges and loopback addresses, it does not block link-local (169.254.0.0/16), CGNAT (100.64.0.0/10), or benchmark (198.18.0.0/15) ranges. Attackers can exploit this to reach the AWS metadata service endpoint (169.254.169.254) or other internal targets. The response body is not returned to the attacker, but the outbound request can be confirmed via timing analysis. The vulnerability is fixed in version 4.6.1.
Affected products
- EmbedPress EmbedPress before 4.6.1
Timeline
- 2026-07-27: disclosed: Publicly disclosed on WPScan
- 2026-07-27: patched: Fixed in version 4.6.1
- 2026-08-04: advisory: Published on NVD