CVE-2026-46697

Name of the Vulnerable Software and Affected Versions Fediverse Embeds versions prior to 1.5.8

Description An unauthenticated REST route 'ftf/media-proxy' (located in includes/Media Proxy.php) allows anonymous visitors to perform a full-read Server-Side Request Forgery (SSRF) or use the system as an open proxy. The endpoint accepts a base64-encoded URL and forwards it to the wp remote get($url) function without enforcing an allowlist of permitted domains. Although a validation mechanism existed, it only set a local $can download media flag that was not utilized, resulting in the full response body being echoed back to the caller.

Recommendations Update to version 1.5.8.