CVE-2026-12516

MediumCVSS 5.3/10Last modified Jul 9, 2026

Description

The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated media-proxying endpoint, allowing anonymous users to make the site fetch arbitrary URLs, including internal and private-network addresses, and read back the response body. This results in a full-read Server-Side Request Forgery and open proxy.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Unknown	Fediverse Embeds	< 1.5.8

References

https://wpscan.com/vulnerability/2ac80164-03b7-4966-b022-833b4194de80/

Timeline

Published: Jul 9, 2026
Last modified: Jul 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-125175.3The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthentica CVE-2026-125188.5A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to ex CVE-2026-125195.0The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a CVE-2026-12526.4The Events Listing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Event URL' parameter in all versions up CVE-2026-125206.4The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and CVE-2026-125228.8The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr() in drivers/modem/vendor_standalone/hl7800.c parses CVE-2026-125237.5Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially craf CVE-2026-125258.8The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, CVE-2026-125268.1The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted u CVE-2026-125276.0A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmwar CVE-2026-125285.4A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instructi CVE-2026-125297.3A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an u