Server-Side Request Forgery in WP Meta SEO Plugin for WordPress

CVE-2026-11370

What is CVE-2026-11370?

The WP Meta SEO plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF), allowing attackers with contributor-level access or higher to exploit the 'new_link' parameter. This vulnerability enables them to initiate web requests to arbitrary locations from the web application. Such actions could potentially expose sensitive internal systems, enabling attackers to query and alter information. Furthermore, the status code from these outbound requests is returned in the AJAX JSON response, which could help attackers identify internal hosts and access metadata from cloud services.

References