CVE-2026-11370 is a Server-Side Request Forgery (SSRF) vulnerability in the WP Meta SEO plugin for WordPress affecting all versions up to 4.5.18. The issue arises from insufficient validation of the 'new_link' parameter, enabling authenticated users with contributor or higher privileges to induce the server to send HTTP requests to arbitrary locations. The server's HTTP response status code is reflected back in the AJAX JSON response, providing an oracle for attackers to enumerate internal hosts and cloud metadata services. This vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity, with impacts on confidentiality and integrity but no direct availability impact. No official patch or remediation guidance is currently provided by the vendor.

An attacker with contributor-level or higher access can leverage this SSRF vulnerability to make the server perform HTTP requests to arbitrary internal or external locations. This can lead to information disclosure by probing internal services and cloud metadata endpoints, potentially exposing sensitive data. The reflected HTTP status codes in responses facilitate reconnaissance of internal network resources. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity related to the 'new_link' parameter. Avoid exposing sensitive internal services that could be targeted via SSRF. Follow vendor communications for updates on patches or official mitigations.