In this scenario, there are two "threat agents":
Ways for the Website to expose you without the help of the VPN server
If you agree to run native code or .NET/Java code with full trust, such as:
The above listed environments allow the program to query details about the native operating environment, which includes a list of all the network cards / interfaces. One of those interfaces would be your local ethernet or wireless interface, which would (at least) contain your Private NAT IP, but may or may not contain your Public IP.
Ways for the VPN server to expose you (intentionally or accidentally)
The VPN itself could be configured to inject a header into HTTP requests giving away your IP address, but that behavior would be fairly unusual for a VPN. This is typically only done by proxies, which are not to be confused with VPNs. Still, an arbitrary, untrusted VPN (one that you do not control, and whose owner you don't fully trust) could seemingly at-will decide that it wants to give away your IP address, and just do it. So you need to trust that the software is not going to do that, and that the owner of the machine isn't going to modify the software to make it do that.
The way you asked the problem is really an information-theoretic problem. We can understand this on simple human interaction terms:
At this point, it is entirely up to Sally, an arbitrary human actor, to decide what they want to do with the following information:
Sally conceivably may:
Whether or not VPN software is by default configured to behave a certain way is a very different question from "is it possible ...".
The short answer is yes, it is possible.
Unless you truly trust the owner/operator of the VPN server, and all of the software running on it, there is always the possibility. And if the owner/operator is a stranger and you have no means of analyzing the software running on the box, you definitely have no reason to suspect that your identity will be protected.