Fediverse Embeds WordPress Plugin Site Info SSRF Vulnerability
The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users (the gating nonce is exposed on public pages carrying an embed) to make the site request internal and private-network URLs and read back the parsed page metadata. This is a Server-Side Request Forgery.
Browse WordPress security risksQuick answer
Fediverse Embeds should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- Fediverse Embeds before 1.5.8
Fixed versions
- 1.5.8
How to fix it
Fediverse Embeds for WordPress before 1.5.8 exposed an unauthenticated site-info SSRF path. Update the plugin and block server-side requests to private, loopback, link-local, and metadata service addresses.
- Inventory WordPress sites running the Fediverse Embeds plugin and identify versions before 1.5.8.
- Update Fediverse Embeds to version 1.5.8 or later from a trusted WordPress source.
- Temporarily disable the plugin if an immediate update is not possible.
- Block outbound HTTP requests from WordPress to private IP ranges, loopback addresses, link-local networks, and cloud metadata endpoints.
- Review web server and WordPress logs for unusual site-info requests or requests targeting internal hostnames.
- Apply least-privilege network egress controls to PHP-FPM or the web server user.
- Purge caches and retest Fediverse embed functionality after patching.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm Fediverse Embeds is running version 1.5.8 or later.
- Verify unauthenticated users cannot use the site-info endpoint to reach internal URLs.
- Test that internal and metadata service URLs are blocked by network egress policy.
- Review access logs for SSRF probes and follow up on any successful internal responses.
- Run a Fixnx scan and confirm the WordPress site does not expose vulnerable plugin endpoints.
Related categories
Related security risks
More published guidance from the same primary category.
Trusted references
FAQ
What is affected by CVE-2026-12517?
Fediverse Embeds versions listed as affected should be reviewed: Fediverse Embeds before 1.5.8.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.