Skip to content
EIEnes Ismaili
2 min read

CVE-2026-11370: an SSRF in WP Meta SEO that maps your internal network

A Contributor account could make the server reach internal hosts and read the answer back through an HTTP status code. How the flaw works and why it is still unpatched.

ResearchDisclosure

I found this while poking at the broken link checker in WP Meta SEO. Broken link checkers are a good place to look, because their entire job is to make the server fetch URLs that other people supply.

The flaw

The plugin exposes an AJAX handler that accepts a new_link parameter and fetches whatever it is given. There is no validation on the URL, no allowlist, no scheme restriction. Any user with Contributor access or above can make the server issue a request to an arbitrary host.

That is a server-side request forgery. On its own, that class of bug is common and often dismissed as low impact. This one has a detail that makes it worth writing about.

The status code is the exfiltration channel

The handler reflects the HTTP status code of the request it made back in the response. That turns a blind SSRF into a clean oracle:

  • 200 means something is listening on that host and port.
  • 403 means something is there but refuses you.
  • A timeout means the host is unreachable or filtered.

With a Contributor account and a loop, that is an internal port scanner. Point it at 169.254.169.254 and it becomes a cloud metadata probe. Point it at your internal admin interfaces and it becomes a map.

Severity and affected versions

CVSS 6.4, Medium. The vector reflects the privileges required, but the practical impact depends on what your network exposes to the web server. On a flat network, Medium is optimistic.

Affects all versions up to and including 4.5.18.

Disclosure

Reported through Wordfence, CVE assigned as CVE-2026-11370. The plugin was discontinued and its features merged into a Pro version, and at the time of writing there is no fix in either.

What to do

  1. Disable the plugin. A broken link checker is not worth an internal network map.
  2. If you cannot disable it, remove Contributor access from anyone who does not need it.
  3. Watch egress from your web tier. A server that cannot reach 169.254.169.254 or your internal admin network cannot enumerate it.

What I took from it

Severity scores describe a bug. They do not describe your exposure. The same SSRF is a nuisance on a segmented network and a serious problem on a flat one, and the difference is architecture, not the CVSS string.

All postsReply by email