The vulnerability resides in the WP Meta SEO WordPress plugin, affecting all releases up to version 4.5.18. An authenticated user with contributor‑level or higher privileges can manipulate the "new_link" parameter in an AJAX call, causing the server to issue arbitrary HTTP requests to any URL. The plugin then returns the HTTP response status in the JSON reply, allowing an attacker to enumerate internal hosts or cloud metadata endpoints and potentially read or alter internal data. This flaw is identified as CWE‑918 and provides a moderate‑risk path for internal network reconnaissance and data exfiltration.

Systems running WordPress with the WP Meta SEO plugin, versions 4.5.18 and earlier. The plugin is developed by joomunited and distributed under the WP Meta SEO product name.

The CVSS score of 6.4 indicates a medium severity flaw, and the EPSS score is not available, suggesting limited public exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the site and hold at least contributor privileges; no remote initiation from outside the site is required. Once authenticated, they can craft URLs to probe internal services or cloud metadata, leading to information disclosure or further compromise.