CVE-2026-46698
5.3 MEDIUMFediverse Embeds embeds fediverse posts on WordPress sites
Published: 2026-06-11 · Last updated: 2026-06-11
Severity and scoring
- CVSS
- 5.3 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CWE
- CWE-918
Description
Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.9, Fediverse Embeds registered the unauthenticated AJAX action wp_ajax_nopriv_ftf_get_site_info (includes/Site_Info.php) that verified a nonce ftf-fediverse-embeds-nonce and then called file_get_html($site_url) on the attacker-supplied URL. The same nonce was enqueued onto every public page containing a fediverse embed (via includes/Enqueue_Assets.php lines 41-46 + includes/Helpers.php lines 64-83), so the nonce gate was not an authentication boundary; any visitor of a public post with an embed could grab it and reuse it. This issue has been patched in version 1.5.9.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-46698
- [Other]https://github.com/stefanbohacek/fediverse-embeds-wordpress-plugin/commit/93821405790ccc7a80528e91b34b624606b54969
- [Other]https://github.com/stefanbohacek/fediverse-embeds-wordpress-plugin/security/advisories/GHSA-cr42-rgq6-whjh
- [Other]https://github.com/stefanbohacek/fediverse-embeds-wordpress-plugin/security/advisories/GHSA-cr42-rgq6-whjh
Related CVEs
Same CWE
- CVE-2026-53812 — OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypa... (7.7 HIGH)
- CVE-2026-53782 — Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to dire... (7.4 HIGH)
- CVE-2026-47170 — Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface (7.7 HIGH)
- CVE-2026-47157 — aiograpi is an asynchronous Instagram API for Python (6.5 MEDIUM)
- CVE-2026-46697 — Fediverse Embeds embeds fediverse posts on WordPress sites (7.5 HIGH)