The vulnerability resides in the get_headers function of index.php in SourceCodester SEO Meta Tag Extractor 1.0. Manipulation of the url argument allows an attacker to influence the request that the server makes to an arbitrary target. This creates a Server‑Side Request Forgery (SSRF) condition, enabling the caller to provoke the server to reach internal services, files, or other external resources that might otherwise be inaccessible. The consequence is the potential compromise of confidentiality, integrity, or availability of internal systems, depending on what resources are accessed.

Affected are installations of SourceCodester SEO Meta Tag Extractor version 1.0, as identified by the CNA product name. No other versions were listed, so the impact is limited to that specific release.

The recorded CVSS score is 6.9, indicating a moderate to high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote, meaning an adversary can trigger the SSRF from outside the network. Since the function is exposed via a publicly accessible endpoint, exploitation requires no privileged access beyond triggering the request; crafted URL parameters can be provided by an attacker to instruct the server to make arbitrary requests.