The Fediverse Embeds WordPress plugin versions prior to 1.5.8 contain an SSRF vulnerability (CWE-918) due to lack of validation on the destination URL of server-side requests performed by an unauthenticated site-info endpoint. Because the gating nonce is publicly exposed on pages with embeds, anonymous users can exploit this to request internal or private network resources and read back metadata from those pages. This could potentially expose sensitive internal information. No official patch or remediation level has been stated in the available data.

An attacker can cause the server hosting the vulnerable plugin to make HTTP requests to internal or private network addresses, potentially exposing sensitive metadata from internal resources. The impact is limited to information disclosure (confidentiality) with no integrity or availability impact reported. The vulnerability requires no privileges and no user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to internal network resources from the web server hosting the plugin if possible, and monitor for unusual outbound requests. Avoid exposing the nonce publicly if feasible. No official patch or temporary fix has been documented in the provided data.