WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter

An authenticated attacker with contributor-level access or higher sends a crafted AJAX request to the `wp_ajax_wpms` action, supplying an arbitrary URL in the `new_link` parameter. The plugin makes an HTTP request to that URL and returns the response status code in the JSON output. This allows the attacker to probe internal network hosts (e.g., 10.0.0.1:80) and cloud metadata endpoints (e.g., 169.254.169.254) by observing which status codes are returned, effectively creating an SSRF oracle [CWE-918] [ref_id=1].

The vulnerability resides in the `startProcess` AJAX handler registered via `add_action('wp_ajax_wpms', array($this, 'startProcess'))` in `class.metaseo-admin.php`. The handler accepts a `new_link` parameter and makes an outbound HTTP request to the attacker-supplied URL without validating the scheme or host, then reflects the HTTP response status code back in the AJAX JSON response.

The advisory does not include a published patch. The recommended remediation is to validate the `new_link` parameter against an allowlist of permitted schemes (e.g., only `http` and `https`) and to block requests to private IP ranges (RFC 1918) and cloud metadata IPs (e.g., 169.254.169.254). Without such validation, any authenticated user with contributor-level access can use the plugin as a proxy to scan internal services.