Description

Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-03T17:17:30.710Z",
  "pubdate": "2026-09-03T17:17:30.710Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in the SEOPress plugin for WordPress, impacting all versions from n/a through 10.1.\nThis vulnerability allows an attacker to manipulate the server into making unauthorized requests to internal or external resources.\nThe flaw stems from insufficient validation of user-supplied input used within request-making functionality.\nSuccessful exploitation can lead to unauthorized access to internal network services, sensitive configuration data exposure, and potential interaction with cloud-based metadata services.\nThe risk is significant as it potentially allows an attacker to bypass perimeter security controls, interact with services not exposed to the public internet, and perform reconnaissance within the internal environment.\nExploitation does not necessarily require advanced authentication depending on the exposed endpoint's accessibility, though specific context within the plugin may govern the attack surface.",
  "technicalDetails": "The vulnerability manifests as a Server-Side Request Forgery (SSRF) within the SEOPress plugin. SSRF occurs when an application fetches a remote resource without properly validating the user-supplied URL or destination host, allowing the application to be coerced into sending forged requests to arbitrary destinations.\nIn the context of SEOPress, the root cause is located in the inadequate sanitization and validation of input parameters that are subsequently utilized by the server to initiate network requests.\nAn attacker can exploit this by crafting a malicious request containing a controlled URL. When the plugin processes this input, it fails to verify if the target host is legitimate or restricted, leading to the server initiating an outbound HTTP or related protocol request to the specified target.\nThe attack flow typically involves the following stages: 1. Identification of the vulnerable endpoint within the SEOPress plugin that handles URL parameters; 2. Crafting an HTTP request (GET/POST) that injects a target URL pointing to an internal resource (e.g., localhost, internal IP addresses, or metadata services like 169.254.169.254) or an external attacker-controlled server; 3. The server, acting as a proxy, executes the request and potentially returns information from the target back to the attacker or performs actions on the target based on the server's context.\nThe affected component is likely a function responsible for external resource fetching, such as link analysis, metadata extraction, or remote asset retrieval. Because the server itself initiates these requests, they may bypass network access control lists (ACLs) or firewalls that would otherwise restrict direct access from the attacker's machine to internal services.\nThe impact includes, but is not limited to: 1. Port scanning and service discovery of the internal network segment hosting the vulnerable server; 2. Interaction with internal web applications or databases that rely on IP-based authentication; 3. Exfiltration of sensitive data, such as cloud environment credentials if metadata services are accessible; 4. Potential for remote code execution if internal services can be manipulated via forged requests.\nThe vulnerability affects all versions of SEOPress from n/a through 10.1. Remediation requires strict input validation and the implementation of a whitelist for allowed domains/protocols to prevent unauthorized request targets."
}