PatchSiren cyber security CVE debrief
CVE-2026-11370 joomunited CVE debrief
The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'new_link' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The HTTP response status from outbound requests is reflected back in the AJAX JSON response as status_code, providing an enumeration oracle usable for probing internal hosts and cloud metadata services. Affected users should update to a patched version as soon as possible. WP Meta SEO users should verify their plugin version and update to a fixed version if they are running a vulnerable version. Users should also review their plugin configurations and ensure that only authorized users have contributor-level access or above.
- Vendor
- joomunited
- Product
- WP Meta SEO
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-24
- Original CVE updated
- 2026-06-29
- Advisory published
- 2026-06-24
- Advisory updated
- 2026-06-29
Who should care
WP Meta SEO users, WordPress administrators, security teams, and organizations using the WP Meta SEO plugin should be aware of this vulnerability. This vulnerability can be used to probe internal hosts and cloud metadata services, potentially leading to further attacks. Security teams should prioritize patching this vulnerability to prevent potential exploitation.
Technical summary
The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of proper validation in the 'new_link' parameter. An authenticated attacker with contributor-level access can make web requests to arbitrary locations, which can be used to query and modify information from internal services. The vulnerability has a CVSS score of 6.4 and a CVSS severity of MEDIUM. The vulnerability was publicly disclosed on June 24, 2026, and the CVE record was last modified on June 25, 2026.
Defensive priority
Patching this vulnerability is of medium priority. WP Meta SEO users should update to a patched version as soon as possible to prevent potential exploitation.
Recommended defensive actions
- Update WP Meta SEO to a patched version
- Review plugin configurations and ensure only authorized users have contributor-level access or above
- Monitor plugin logs for suspicious activity
- Implement additional security measures to detect and prevent SSRF attacks
- Verify internal services and cloud metadata services are properly secured
Evidence notes
The CVE record and NVD detail provide information on the vulnerability, including its CVSS score and severity. The source item URL provides additional information on the vulnerability, including references to the vulnerable code. The CVE record was last modified on June 25, 2026, indicating that the vulnerability is actively being monitored and updated.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-11370 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-11370
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-11370 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11370
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-admin.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-broken-link-table.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-broken-link-table.php
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.