CVE-2026-46698: 
WordPress vulnerability analysis and mitigation

CVE-2026-46698 is a Server-Side Request Forgery (SSRF) vulnerability in the Fediverse Embeds WordPress plugin that allows unauthenticated attackers to make the server issue HTTP requests to arbitrary URLs, including internal network resources. It affects all versions up to and including 1.5.7 (prior to 1.5.9). The vulnerability was discovered by researcher 0xBassia, disclosed to the maintainer on 2026-05-14, and patched in version 1.5.9 released on 2026-05-15. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the plugin registered an unauthenticated AJAX action wp_ajax_nopriv_ftf_get_site_info in includes/Site_Info.php that accepted an attacker-supplied URL parameter and passed it directly to file_get_html($site_url) without validating the destination host. Although the endpoint verified a WordPress nonce (ftf-fediverse-embeds-nonce), this nonce was publicly embedded in every page containing a fediverse embed (via includes/Enqueue_Assets.php lines 41–46 and includes/Helpers.php lines 64–83), making it accessible to any anonymous visitor and rendering the nonce check ineffective as an authentication boundary. An attacker could extract the nonce from any public page with an embed and then POST to /wp-admin/admin-ajax.php with action=ftf_get_site_info and an arbitrary internal URL (e.g., http://127.0.0.1/, http://169.254.169.254/ for AWS metadata). The endpoint returned parsed Open Graph metadata from the target URL rather than the full response body, limiting but not eliminating information disclosure (GitHub Advisory, Patch Commit).

Successful exploitation allows any unauthenticated attacker to probe internal network services and cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) reachable from the WordPress server, resulting in limited confidentiality impact through exposure of parsed Open Graph metadata from internal resources. While integrity and availability are not directly affected, the SSRF could facilitate reconnaissance of internal infrastructure, service enumeration, or extraction of cloud instance metadata that could enable further privilege escalation. The impact is lower than a full-body SSRF because only parsed Open Graph fields are returned, not raw HTTP responses (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Fediverse Embeds plugin (versions ≤ 1.5.7) by searching for characteristic embed markup or plugin references in page source, or using tools like WPScan.
2. Extract the public nonce: Visit any public post on the target site that contains a fediverse embed and extract the ftf-fediverse-embeds-nonce value from the page's JavaScript or inline script tags.
3. Craft the SSRF request: Send a POST request to the WordPress AJAX endpoint with the extracted nonce and a target internal URL:

curl -i -X POST http://target/wp-admin/admin-ajax.php \
  -d action=ftf_get_site_info \
  --data-urlencode url=http://169.254.169.254/latest/meta-data/ \
  -d nonce=<extracted_nonce>

4. Retrieve internal data: The server fetches the specified internal URL and returns a JSON object containing parsed Open Graph metadata from the internal resource, potentially exposing cloud metadata, internal service banners, or network topology information (GitHub Advisory).

• Network: Outbound HTTP requests from the WordPress server to RFC-1918 addresses (10.x.x.x, 172.16–31.x.x, 192.168.x.x), loopback (127.0.0.1), or cloud metadata IPs (169.254.169.254) originating from the web server process.
• Logs: WordPress access logs showing repeated POST requests to /wp-admin/admin-ajax.php with action=ftf_get_site_info and url parameters containing internal or non-public addresses; unusual response sizes from this endpoint.
• Logs: PHP error logs or web server logs showing file_get_html() calls to internal hostnames or IP ranges.
• Network: DNS queries from the WordPress server for internal hostnames or unusual external domains not associated with fediverse platforms, triggered by attacker-supplied URLs.

Update the Fediverse Embeds WordPress plugin to version 1.5.9 or later, which adds an is_safe_url() check in Site_Info.php::get_site_info() that validates the destination host against private and reserved IP ranges before making any outbound request. The fix also refactors the is_safe_host() and is_safe_url() helper methods into the shared Helpers class for consistent enforcement across all SSRF-susceptible endpoints. No configuration-based workaround is available for unpatched versions; disabling the plugin entirely is the only alternative mitigation until an upgrade can be applied (GitHub Advisory, Patch Commit).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the week of June 8–14, 2026, noting it as a medium-severity SSRF issue. The maintainer responded promptly to the responsible disclosure, confirming and shipping a patch within approximately 14 hours of the initial report. No broader media coverage or significant community debate has been observed beyond standard vulnerability tracking platforms.