CVE-2026-46698

Name of the Vulnerable Software and Affected Versions Fediverse Embeds versions prior to 1.5.9

Description The software registers an unauthenticated AJAX action wp ajax nopriv ftf get site info (located in includes/Site Info.php) that processes a URL provided by the user via the $site url variable using the file get html() function. Although the action verifies a nonce ftf-fediverse-embeds-nonce, this nonce is enqueued on every public page containing a fediverse embed, allowing any visitor to obtain and reuse it, effectively bypassing the intended authentication boundary.

Recommendations Update to version 1.5.9.