The plugin registers an unauthenticated AJAX endpoint that uses a nonce originally intended only for a client‑side check. Because the same nonce is rendered on every public page containing a Fediverse embed, any visitor can obtain it and invoke the endpoint with an arbitrary URL. The server then performs an HTTP GET to that URL via file_get_html, enabling a server‑side request forgery. An attacker can direct internal or public network requests, potentially exposing sensitive services, leaking data, or abusing internal resources. This is a classic SSRF weakness (CWE‑918).

The vulnerability is present in the Fediverse Embeds WordPress plugin (vendor stefanbohacek) on any WordPress installation running a version prior to 1.5.9. Public pages that include a Fediverse embed are required to obtain the shared nonce; therefore every site using the plugin before the fix is affected.

The CVSS score of 5.3 indicates a moderate severity. No EPSS value is published, so the exact exploitation probability is unknown. The vulnerability is not listed in CISA KEV. Attackers need only visit a public page that contains a Fediverse embed to capture the nonce and then send a crafted AJAX request. Because the action is unauthenticated and the nonce is globally available, the exploitation requirement is low, making it reasonably likely in an environment where the plugin is deployed and public posts exist.