CVE-2026-11370

The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'new_link' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The HTTP response status from outbound requests is reflected back in the AJAX JSON response as status_code, providing an enumeration oracle usable for probing internal hosts and cloud metadata services.

• CWE-918

• https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-admin.php#L4783
• https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-broken-link-table.php#L1138
• https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-broken-link-table.php#L2013
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6e37c1-aaac-4642-bace-234bbc4f6c38?source=cve

Published

Jun 24, 2026

Last Modified

Jun 29, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11364The Product Specifications for WooCommerce plugin for WordPr…4.3
• CVE-2026-11366The MonsterInsights WordPress plugin before 11.1.0 does not…3.7
• CVE-2026-11367The PixMagix – WordPress Image Editor plugin for WordPress i…6.5
• CVE-2026-11368The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) a…6.5
• CVE-2026-11369The Comment API (GET /api/Comment and POST /api/Comment) in …7.1
• CVE-2026-1137A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Af…8.8
• CVE-2026-11371The BetterDocs WordPress plugin before 4.5.5 does not sanit…6.1
• CVE-2026-11372IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vuln…5.4
• CVE-2026-11373Net::Statsite::Client versions through 1.1.0 for Perl allow …9.1
• CVE-2026-11374In ManageEngine ADSelfService Plus, RecoveryManager Plus, M3…9
• CVE-2026-11379GitLab has remediated an issue in GitLab EE affecting all ve…5.3
• CVE-2026-1138A flaw has been found in UTT 进取 520W 1.7.7-180627. This affe…8.8