CVE-2026-10287 describes a server-side request forgery vulnerability in SourceCodester SEO Meta Tag Extractor 1.0. The issue arises from improper validation or sanitization of the url parameter passed to the get_headers function in /index.php, enabling remote attackers to coerce the server into making arbitrary HTTP requests. This vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9 (medium severity). No official patch or vendor remediation guidance is currently documented.

Successful exploitation allows an attacker to induce the vulnerable server to perform HTTP requests to arbitrary internal or external resources. This can lead to information disclosure, internal network scanning, or interaction with otherwise inaccessible services. However, no direct evidence of exploitation in the wild has been reported, and the impact is rated medium severity based on CVSS 4.0 metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing network-level restrictions to limit outbound HTTP requests from the affected server or apply input validation controls to the url parameter if possible. Monitor vendor channels for updates regarding patches or official mitigations.