SEOPress plugin versions up to and including 10.1 contain an SSRF flaw that lets an attacker supply arbitrary URLs for the plugin to fetch. Abuse of this bug can expose internal network resources, retrieve sensitive data from private endpoints, or enable further lateral movement. The vulnerability is classified as CWE‑918 – Server Side Request Forgery. The primary impact is the ability to initiate outbound HTTP requests on behalf of the WordPress server, potentially bypassing network restrictions.

Any WordPress installation running the SEOPress plugin with a version of 10.1 or earlier is affected. The vulnerability is present from the earliest release of the plugin through version 10.1.

The CVSS score of 5.4 indicates moderate severity. No EPSS data is currently available, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector involves submitting a specially crafted URL to the plugin’s endpoint, which may require authentication to the WordPress admin interface; however the exact prerequisites are not specified in the description, so it is inferred that an authenticated user could trigger the SSRF. Detection of exploitation is difficult from logs alone, as the plugin’s network calls are made server‑side and may appear as normal outbound traffic.