CyberRota Analysis
AI-GeneratedThe Fediverse Embeds WordPress plugin versions prior to 1.5.8 are vulnerable to Server-Side Request Forgery (SSRF), allowing unauthenticated users to exploit an exposed site-info endpoint. This vulnerability enables attackers to make requests to internal and private-network URLs, potentially exposing sensitive metadata. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of unauthorized data exposure.
Original NVD Description
The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users (the gating nonce is exposed on public pages carrying an embed) to make the site request internal and private-network URLs and read back the parsed page metadata. This is a Server-Side Request Forgery.