CVE-2026-12517

MediumCVSS 5.3

Published: 09/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The Fediverse Embeds WordPress plugin before version 1.5.8 does not validate the destination URL of server-side requests made by an unauthenticated site-info endpoint. This allows anonymous users (the nonce is exposed on public pages with an embed) to make the site request internal and private network URLs and read back the parsed page metadata.

Risk Assessment

An attacker can exploit this vulnerability to scan the internal network, access confidential resources, or perform attacks on other internal systems, potentially leading to data leakage or infrastructure compromise.

Recommendation

Immediately update the Fediverse Embeds plugin to version 1.5.8 or later, which includes a fix that validates the destination URLs of server-side requests.

Other vulnerabilities in Fediverse Embeds

CVE-2026-12516Medium
The Fediverse Embeds WordPress plugin before version 1.5.8 does not validate the destination URL of a server-side request made by an unauthenticated media-proxying endpoint. This allows anonymous users to fetch arbitrary URLs, including internal and private network addresses, and read back the response body.

Original NVD description (English source)

The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users (the gating nonce is exposed on public pages carrying an embed) to make the site request internal and private-network URLs and read back the parsed page metadata. This is a Server-Side Request Forgery.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS