CVE-2026-46698: Fediverse Embeds SSRF Vulnerability (v1.5.9 Patch)

Technical summary

CVE-2026-46698 is an SSRF vulnerability in the Fediverse Embeds plugin's unauthenticated AJAX endpoint wp_ajax_nopriv_ftf_get_site_info. The endpoint accepts a user-supplied URL and passes it directly to file_get_html($site_url) without proper validation. Although the endpoint attempts to verify a nonce (ftf-fediverse-embeds-nonce), the nonce is enqueued on all public pages containing an embed, making it publicly harvested by any site visitor. An attacker can extract the nonce from a public page, replay it in a crafted request, and force the server to make HTTP requests to arbitrary internal or external URLs. This allows the attacker to probe internal network topology, access internal web services, or trigger server-side interactions without authentication.

Business impact

Organizations running WordPress sites with Fediverse Embeds before 1.5.9 face two key risks: (1) information disclosure—attackers can trigger internal HTTP requests and read responses, potentially exposing internal IP addresses, service configurations, or sensitive data accessible only from the server; (2) lateral movement facilitation—if internal services are accessible via HTTP from the WordPress server, attackers may interact with them to pivot deeper into the network. The vulnerability requires no user interaction beyond visiting a public page, making it trivial to exploit at scale. Sites embedding fediverse content are directly at risk; compromise severity depends on what internal resources the WordPress server can reach.

Affected systems

The Fediverse Embeds WordPress plugin in versions prior to 1.5.9 is affected. Any WordPress installation with this plugin enabled and containing at least one fediverse embed on a publicly accessible page is vulnerable. The vulnerability affects both single-site and multisite WordPress installations. No CVSS:v3.1 severity component filtering occurs—all WordPress versions and hosting configurations running the vulnerable plugin are equally exposed.

Exploitability

Exploitability is straightforward. An attacker requires no authentication, special privileges, or user interaction beyond visiting a public page to harvest the nonce. The attack surface is high: any visitor of a public post with an embed can extract the nonce and craft an AJAX request. Network access and low attack complexity make this a practical exploitation target. The CVSS score of 5.3 reflects the limited direct impact (information disclosure only, no direct code execution or service denial), but the ease of exploitation and reusable nonce mechanism warrant immediate patching in production environments.

Remediation

Update Fediverse Embeds to version 1.5.9 or later immediately. This patch version addresses the nonce reusability issue and likely implements proper SSRF mitigations such as URL validation, hostname whitelisting, or disabling server-side fetching altogether. After patching, monitor access logs for suspicious AJAX requests to wp-admin/admin-ajax.php with action=ftf_get_site_info to detect any exploitation attempts that occurred before the patch was applied.

Patch guidance

Verify that Fediverse Embeds has been updated to version 1.5.9 or later via the WordPress Plugins admin page or by inspecting the plugin's readme.txt or main plugin file for the version number. Confirm the patch was applied by checking that the wp_ajax_nopriv_ftf_get_site_info action either no longer exists or now includes proper SSRF protections. Test the plugin's core functionality (embed display) after patching to ensure no regressions. For multisite installations, ensure all affected sites update the plugin simultaneously.

Detection guidance

Search access logs (typically wp-content/plugins/fediverse-embeds/ or apache/nginx access logs) for POST requests to /wp-admin/admin-ajax.php with action=ftf_get_site_info containing suspicious URLs in the request body (internal IPs, localhost, or unusual domain names). Track the nonce parameter ftf-fediverse-embeds-nonce across requests; repeated use of the same nonce value from different IP addresses or user agents suggests nonce harvesting. Monitor outbound HTTP connections from the WordPress server to unexpected or internal destinations. WAF rules blocking SSRF patterns (requests to 127.0.0.1, 10.x.x.x, 172.16.x.x, 192.168.x.x, or metadata service endpoints) can catch exploitation attempts in real time.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), this vulnerability merits high-priority remediation because: (1) it requires zero authentication and near-zero attacker effort; (2) the nonce reusability is a design flaw that persists across all public pages; (3) it enables reconnaissance of internal infrastructure without triggering traditional security controls; (4) WordPress plugins are frequently targeted by automated scanning. Prioritize patching based on site visibility—sites embedding fediverse content are actively advertising the plugin's presence.

Risk score, explained

The CVSS:3.1 score of 5.3 (MEDIUM) reflects a low-complexity, unauthenticated network attack with no user interaction required (AV:N, AC:L, PR:N, UI:N), resulting in only confidentiality impact (C:L) and no integrity or availability loss (I:N, A:N). The score correctly caps at MEDIUM because direct information disclosure, while valuable for reconnaissance, does not constitute high-severity impact in isolation. However, the practical ease of exploitation and the reusable nonce design flaw elevate operational risk beyond the numerical score. Organizations should treat this as a priority patch despite the MEDIUM rating.

Frequently asked questions