CVE-2026-12517 is a Server-Side Request Forgery vulnerability in the Fediverse Embeds WordPress plugin prior to version 1.5.8. The vulnerability arises from the lack of validation on the destination URL of server-side requests performed by an unauthenticated site-info endpoint. Because the gating nonce is exposed on public pages containing embeds, anonymous users can abuse this to make the server request internal or private network resources and read back the parsed metadata, potentially exposing sensitive internal information.

An attacker can make the vulnerable WordPress site perform requests to internal or private network URLs, potentially accessing sensitive internal services or data that are not otherwise publicly accessible. The attacker can then read the parsed metadata from these requests, which may lead to information disclosure about internal network resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to internal network resources from the web server and monitor for unusual outbound requests. Avoid exposing the nonce publicly if possible.