# CVE-2026-11370: JoomUnited WP Meta SEO SSRF via new_link parameter

Source: https://junglewise.ai/threats/cve-2026-11370-joomunited-wp-meta-seo-ssrf-via-new-link-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-11370 · Severity: medium · CVSS 6.4 · Published 2026-06-24

WP Meta SEO is a WordPress plugin used to manage search engine optimization and broken links. A security flaw allows logged-in users with contributor-level access or higher to force the website to make unauthorized requests to internal or external servers. This could be used to scan internal networks, access sensitive cloud metadata, or interact with internal services that are not normally accessible from the internet.

Vendors: [JoomUnited](https://junglewise.ai/threats/vendors/joomunited).

## Quick answers

**Is CVE-2026-11370 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11370 being exploited in the wild.

**How severe is CVE-2026-11370?** Medium severity, with a CVSS score of 6.4, published 24 June 2026.

**Which products and versions are affected?** JoomUnited WP Meta SEO up to, and including, 4.5.18.

**Is there a fix for CVE-2026-11370?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11370 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11370?** Check whether you run JoomUnited WP Meta SEO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the WP Meta SEO plugin due to insufficient validation of the 'new_link' parameter. Authenticated attackers with contributor-level permissions or higher can exploit this to make the server initiate outbound HTTP requests to arbitrary IP addresses or domains. The application reflects the HTTP response status code back in an AJAX JSON response, effectively creating an enumeration oracle. This can be leveraged to scan internal network hosts, query local services, or access cloud provider metadata services (e.g., AWS/GCP metadata endpoints). The vulnerability is present in all versions up to and including 4.5.18.

## Affected products

- JoomUnited WP Meta SEO up to, and including, 4.5.18

## Timeline

- 2026-06-24: disclosed
- 2026-06-24: advisory

## References

- [https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-admin.php](https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-admin.php)
- [https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-broken-link-table.php](https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-broken-link-table.php)
- [https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-broken-link-table.php](https://plugins.trac.wordpress.org/browser/wp-meta-seo/tags/4.5.18/inc/class.metaseo-broken-link-table.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6e37c1-aaac-4642-bace-234bbc4f6c38?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6e37c1-aaac-4642-bace-234bbc4f6c38?source=cve)

## Related threats

- [JoomUnited WP Meta SEO unauthenticated stored XSS in 404 handler](https://junglewise.ai/threats/cve-2026-9643-joomunited-wp-meta-seo-unauthenticated-stored-xss-in-404-handler)