CVE-2026-46698

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-46698

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46698.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-46698

Aliases

GHSA-cr42-rgq6-whjh

Published

2026-06-11T17:15:52.767Z

Modified

2026-07-08T08:13:52.668638035Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Fediverse Embeds: Public-nonce SSRF via ftf_get_site_info AJAX action

Details

Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.9, Fediverse Embeds registered the unauthenticated AJAX action wpajaxnoprivftfgetsiteinfo (includes/SiteInfo.php) that verified a nonce ftf-fediverse-embeds-nonce and then called filegethtml($siteurl) on the attacker-supplied URL. The same nonce was enqueued onto every public page containing a fediverse embed (via includes/Enqueue_Assets.php lines 41-46 + includes/Helpers.php lines 64-83), so the nonce gate was not an authentication boundary; any visitor of a public post with an embed could grab it and reuse it. This issue has been patched in version 1.5.9.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "1.5.9"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46698.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

Git / github.com/stefanbohacek/fediverse-embeds-wordpress-plugin

Affected ranges

Type

GIT

Repo

https://github.com/stefanbohacek/fediverse-embeds-wordpress-plugin

Events

Introduced

Fixed

93821405790ccc7a80528e91b34b624606b54969

Database specific

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46698.json"