Read the docs
TI-2026-34326 Aliases CVE-2026-46697

Fediverse Embeds: Unauthenticated SSRF / open proxy via REST media-proxy endpoint

Priority LOW 38CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unauthenticated REST route ftf/media-proxy (includes/Media_Proxy.php) with permission_callback => __return_true that accepted a base64-encoded URL and forwarded it to wp_remote_get($url) without enforcing any allowlist. The plugin's source contained a comment block explicitly acknowledging that the request should be validated against allowed fediverse domains, but in 1.5.7 the validation only set a local $can_download_media flag that was never read. The full response body was echoed back to the caller, so this was a full-read SSRF / open proxy reachable by any anonymous visitor. This issue has been patched in version 1.5.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00234 14th percentileScored 2026-11-07
Fix Fixed fediverse-embeds-wordpress-plugin (stefanbohacek): 1.5.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
stefanbohacekfediverse-embeds-wordpress-pluginbefore 1.5.81.5.8Patch availableCNA
  • fediverse-embeds-wordpress-plugin Vendorstefanbohacek Affected before 1.5.8 Fixed in 1.5.8 Patch available CNA

Remediation

  • Fix · CNA fediverse-embeds-wordpress-plugin (stefanbohacek) Fixed in 1.5.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46697

References

Other 2

  • TI-2026-34327 Fediverse Embeds: Public-nonce SSRF via ftf_get_site_info AJAX action CVSS 3.1MEDIUM 5.3
  • TI-2024-35147 WordPress Fediverse Embeds plugin <= 1.5.3 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences