Executive brief
Fediverse Embeds is a WordPress plugin used to display social media posts from the Fediverse on websites. A security flaw allows unauthenticated visitors to force the website's server to make requests to internal or external web addresses. This could allow an attacker to scan internal networks or access sensitive metadata from the server's hosting environment, potentially leading to information disclosure.
Technical details
The Fediverse Embeds plugin for WordPress (prior to version 1.5.9) is vulnerable to Server-Side Request Forgery (SSRF) via the 'wp_ajax_nopriv_ftf_get_site_info' AJAX action. The 'get_site_info' function in 'includes/Site_Info.php' uses 'file_get_html()' on a user-supplied URL without sufficient validation or allowlisting. While the endpoint checks for a WordPress nonce ('ftf-fediverse-embeds-nonce'), this nonce is enqueued on every public page containing an embed, making it accessible to unauthenticated visitors. An attacker can retrieve this nonce and use it to trigger requests to internal network resources or cloud metadata services (e.g., AWS IMDS). The vulnerability is mitigated by the fact that the endpoint only returns parsed Open Graph metadata rather than the full response body. The issue was patched in version 1.5.9 by implementing a URL safety check.
Affected products
- stefanbohacek Fediverse Embeds < 1.5.9
Timeline
- 2026-05-14: disclosed: Vulnerability reported to maintainer
- 2026-05-15: patched: Version 1.5.9 published with fix
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-06-11: advisory: CVE-2026-46698 published to NVD