Performance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter

An attacker can leverage this SSRF vulnerability to perform reconnaissance within the internal network. By crafting malicious requests through the vulnerable endpoint, they can probe internal services and identify potential targets for further exploitation. The use of protocols like Gopher expands the attack surface, allowing attackers to bypass certain security restrictions. The most concerning impact arises from the potential for chaining this SSRF vulnerability with other services, such as Redis, to achieve Remote Code Execution. If Redis is exposed and vulnerable, an attacker could potentially gain full control of the WordPress server.

WordPress sites utilizing the Performance Monitor plugin, particularly those with internal services like Redis exposed or accessible from the web, are at significant risk. Shared hosting environments where plugin updates are managed by the hosting provider may be delayed in receiving the fix, increasing their exposure window.

• wordpress / composer / npm:

grep -r 'wp-json/performance-monitor/v1/curl_data' /var/www/html/

• generic web:

curl -I https://your-wordpress-site.com/wp-json/performance-monitor/v1/curl_data

• wordpress / composer / npm:

wp plugin list | grep 'Performance Monitor'

• wordpress / composer / npm:

wp plugin status | grep 'Performance Monitor'

1. 2026-03-20Disclosure

   disclosure

1. Réservé2026-01-29
2. Publiée2026-03-20
3. Modifiée2026-04-09
4. EPSS mis à jour2026-03-28

The primary mitigation is to upgrade the Performance Monitor plugin to a version that addresses this vulnerability. Unfortunately, a fixed version is not yet available. As a temporary workaround, restrict access to the '/wp-json/performance-monitor/v1/curl_data' endpoint using a web application firewall (WAF) or proxy server. Implement strict input validation on the 'url' parameter, ensuring that only allowed protocols and domains are permitted. Consider disabling the plugin entirely if immediate upgrade is not possible. Monitor WordPress logs for suspicious activity related to the plugin’s API endpoint.

Installations actives

70

Note du plugin