EUVD-2026-70557
GHSA-w6wv-5368-gq95
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L reflects required WordPress authentication; UI:R reflects required triggering action; S:C and C:L/I:L reflect SSRF reaching internal systems with limited direct read/write impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery.
This issue affects SEOPress: from n/a through 10.1.
AnalysisAI
Server-Side Request Forgery in the SEOPress WordPress plugin (through version 10.1) allows an authenticated attacker with low privileges to induce the server to make HTTP requests to arbitrary internal or external targets, potentially exposing internal network services and metadata endpoints. The S:C scope change in the CVSS vector confirms the vulnerability crosses trust boundaries - the plugin's server-side requests can reach systems beyond the WordPress host itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with at minimum low-privilege access (subscriber or contributor level), consistent with PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) yields a base score of 5.4, which reasonably characterizes this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update SEOPress to a version above 10.1 - the exact patched release is not confirmed in the available data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-seopress/vulnerability/wordpress-seopress-plugin-10-1-server-side-request-forgery-ssrf-vulnerability for the confirmed fix version and changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with anot
The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-p
The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contri
The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/sr
The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high
The SEOPress - On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social ima
The SEOPress - On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter
The SEOPress - On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and descr
The SEOPress - On-site SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_qu
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today