EUVD-2026-70557
GHSA-w6wv-5368-gq95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege WordPress account
-
DeliveryCraft request with internal SSRF target URL
-
ExploitTrigger SEOPress server-side URL fetch
-
ExecutionServer contacts internal resource (e.g., IMDS endpoint)
-
ImpactHarvest response data (credentials/internal config)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid WordPress account with at minimum low-privilege access (subscriber or contributor level), consistent with PR:L in the CVSS vector. User interaction (UI:R) is required, meaning the attacker or victim must perform some action within WordPress that triggers SEOPress's server-side URL fetch. The specific plugin feature or endpoint vulnerable to SSRF is not named in the available data - the Patchstack advisory is the authoritative source for the exact trigger. Exploitation is limited by: (1) required WordPress authentication, (2) required user interaction, and (3) the degree to which the WordPress server can reach sensitive internal resources (cloud IMDS, internal APIs) - sites without such backend exposure have reduced real-world impact. |
| Impact | The provided CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) yields a base score of 5.4, which reasonably characterizes this vulnerability. PR:L confirms exploitation requires an authenticated WordPress account (at minimum subscriber or contributor level), and UI:R indicates some user-triggered action is necessary - both factors meaningfully reduce exploitability compared to unauthenticated SSRF. The scope change (S:C) elevates the realistic impact because SSRF in cloud-hosted WordPress environments can expose AWS/GCP/Azure IMDS metadata endpoints, yielding IAM credentials. EPSS data is not available in the input; the vulnerability is not in CISA KEV. No POC has been disclosed. Real-world priority is moderate: sites hosted on cloud infrastructure with permissive metadata endpoints are at greater risk than self-hosted on-premises deployments. The combination of required authentication and user interaction limits mass exploitation, but targeted abuse against specific WordPress sites with low-privilege accounts remains plausible. |
| Exploit ScenarioDerived | An attacker with a low-privilege WordPress account (e.g., subscriber) triggers a site action that causes SEOPress to fetch a URL they control - such as a custom Open Graph URL or link-check target - substituting an internal address such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. The server responds with cloud IAM credentials, which the attacker harvests to pivot into the cloud account. No public POC exists but the attack pattern is well-understood for SSRF in WordPress plugin contexts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Server-Side Request Forgery in the SEOPress WordPress plugin (through version 10.1) allows an authenticated attacker with low privileges to induce the server to make HTTP requests to arbitrary internal or external targets, potentially exposing internal network services and metadata endpoints. The S:C scope change in the CVSS vector confirms the vulnerability crosses trust boundaries - the plugin's server-side requests can reach systems beyond the WordPress host itself. No public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Update SEOPress to a version above 10.1 - the exact patched release is not confirmed in the available data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-seopress/vulnerability/wordpress-seopress-plugin-10-1-server-side-request-forgery-ssrf-vulnerability for the confirmed fix version and changelog. As a compensating control while patching, restrict WordPress user registration to trusted roles only and disable untrusted low-privilege accounts, since PR:L requires an authenticated session. For cloud-hosted WordPress, restrict access to the instance metadata service (IMDS) at the network or hypervisor level - AWS IMDSv2 with hop-limit=1, Azure IMDS firewall rules, or GCP metadata server access controls will prevent the most severe chained impact. Site administrators using WAF products (Wordfence, Patchstack, Cloudflare) should enable SSRF-specific firewall rules as an interim measure. Note that blocking metadata endpoints is a network-level change that requires infrastructure access and may affect other legitimate services relying on IMDS.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SEOPress is a WordPress SEO plugin (CPE: cpe:2.3:a:seopress:seopress:*:*:*:*:*:*:*:*) that processes URLs server-side for purposes such as fetching Open Graph metadata, checking links, or importing content. CWE-918 (Server-Side Request Forgery) describes a root cause where user-supplied URL input is passed to a server-side HTTP request without adequate validation or allowlist enforcement. This allows an attacker to redirect the server's HTTP client to internal RFC-1918 addresses, cloud metadata endpoints (e.g., 169.254.169.254), or other sensitive internal services not directly accessible from the internet. The CVSS scope change (S:C) reflects that exploitation impacts systems beyond the vulnerable WordPress installation itself.
Know when Seopress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L reflects required WordPress authentication; UI:R reflects required triggering action; S:C and C:L/I:L reflect SSRF reaching internal systems with limited direct read/write impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery.
This issue affects SEOPress: from n/a through 10.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with anot
The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-p
The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contri
The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/sr
The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high
The SEOPress - On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social ima
The SEOPress - On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter
The SEOPress - On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and descr
The SEOPress - On-site SEO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_qu
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Acce
Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Acce
Exploit-DB