CVE-2026-12516

3th percentile - higher than 3% of all known CVEs

The Fediverse Embeds WordPress plugin before version 1.5.8 does not validate the destination URL of a server-side request made by an unauthenticated media-proxying endpoint. This allows anonymous users to fetch arbitrary URLs, including internal and private network addresses, and read back the response body.

The organization is at risk of confidential data leakage from the internal network and the server being used as an open proxy for attacks on other systems. An attacker can scan internal resources and read their content without authorization.

Immediately update the Fediverse Embeds plugin to version 1.5.8 or later. If an update is not possible, temporarily disable the media-proxying endpoint or restrict access to it using firewall rules.