What is the CVSS score of EUVD-2026-38660?

EUVD-2026-38660 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

WP Meta SEO EUVD-2026-38660

| CVE-2026-11370 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-24 Wordfence

GHSA-pcx4-v3rh-gq5x

SSRF Oracle WordPress Wp Meta Seo

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Network-reachable AJAX endpoint requires only contributor auth (PR:L); scope change to internal systems (S:C) is the key differentiator; no availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 07:05 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

MEDIUM 6.4

DescriptionCVE.org

The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'new_link' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The HTTP response status from outbound requests is reflected back in the AJAX JSON response as status_code, providing an enumeration oracle usable for probing internal hosts and cloud metadata services.

AnalysisAI

Server-Side Request Forgery in the WP Meta SEO WordPress plugin (all versions through 4.5.18) enables authenticated contributors to coerce the web server into issuing arbitrary outbound HTTP requests via the new_link parameter, with the response status code reflected back through the AJAX JSON response as status_code. This status-code oracle allows methodical enumeration of internal network hosts and cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), making it particularly dangerous in cloud-hosted WordPress deployments. No public exploit identified at time of analysis, though the vulnerability is confirmed by Wordfence with direct source code references and the technique is well-understood.

Technical ContextAI

The flaw resides in JoomUnited's WP Meta SEO plugin (CPE: cpe:2.3:a:joomunited:wp_meta_seo:*:*:*:*:*:*:*:*), specifically in the broken link checker functionality. Wordfence source references pin the vulnerable code to inc/class.metaseo-broken-link-table.php at lines 1138 and 2013, and inc/class.metaseo-admin.php at line 4783 - indicating multiple code paths accept user-supplied URLs without restricting the target destination. CWE-918 (Server-Side Request Forgery) identifies the root cause: the application initiates outbound HTTP requests using attacker-controlled input without validating that the destination is a legitimate external resource. The oracle characteristic - returning the HTTP status code of the server-side request in the AJAX response - elevates this beyond a blind SSRF, enabling binary enumeration of internal infrastructure without needing to read response bodies.

RemediationAI

No specific patched version is confirmed from the available input data - organizations should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6e37c1-aaac-4642-bace-234bbc4f6c38 for a fix release and upgrade beyond 4.5.18 as soon as one is available. As immediate compensating controls: restrict or disable open contributor-level registration to prevent untrusted users from obtaining the minimum required privilege. Implement server-side egress filtering to block outbound HTTP requests to RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the cloud link-local metadata IP 169.254.169.254 - this prevents the most high-value SSRF targets without breaking normal plugin functionality but requires network-level enforcement. For AWS-hosted instances, migrate to IMDSv2 (which requires session-oriented PUT requests that SSRF cannot easily forge) to reduce cloud metadata exposure as a defense-in-depth measure. If the broken link checker feature is not in active use, disabling it eliminates the attack surface entirely.