Executive brief
The Fediverse Embeds plugin for WordPress, which allows websites to display content from social networks like Mastodon, contains a security flaw that allows unauthorized users to probe internal networks. By exploiting this vulnerability, an attacker can force the website's server to make requests to internal systems or private addresses that are not normally accessible from the internet. This could lead to the exposure of sensitive metadata or information about the organization's internal infrastructure.
Technical details
The Fediverse Embeds plugin fails to validate the destination URL in the 'ftf_get_site_info' AJAX action before performing a server-side request. Although the endpoint technically requires a nonce, this security token is leaked on public pages containing embeds, or can be bypassed entirely if the FTF_FEDIVERSE_EMBEDS_PUBLIC_ACCESS constant is set. An unauthenticated attacker can use this to perform SSRF attacks against internal or private-network URLs. The plugin then returns parsed page metadata (such as Open Graph titles and descriptions) from the internal target to the attacker. This issue was fixed in version 1.5.8.
Affected products
- Unknown Fediverse Embeds < 1.5.8
Timeline
- 2026-06-18: disclosed: Publicly published by WPScan
- 2026-06-18: patched: Fixed in version 1.5.8
- 2026-07-09: advisory: NVD publication date