The Fediverse Embeds WordPress plugin before version 1.5.8 does not validate the destination of a server‑side request performed by an unauthenticated site‑info endpoint. This flaw allows anonymous users to fetch arbitrary internal or private‑network URLs and return the parsed page metadata. The result is a server‑side request forgery that exposes internal network information to any visitor.

Fediverse Embeds WordPress plugin versions older than 1.5.8 are affected. The vulnerable site‑info endpoint is publicly accessible and requires no authentication, meaning all site visitors can trigger the SSRF flaw.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % shows a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, so no known widespread exploitation is reported. Attackers can use the endpoint to probe internal hosts, harvest metadata from private URLs, and potentially map internal services, though the impact is limited to the information returned by the request.