An unauthenticated attacker can send a crafted request to the /wp-json/performance-monitor/v1/curl_data REST endpoint, allowing the WordPress site to initiate outgoing requests to arbitrary URLs, including internal services and protocols such as Gopher. This server‑side request forgery can be chained with vulnerable back‑end services like Redis to achieve remote code execution. The possible impact spans loss of confidentiality, integrity, and availability of the affected WordPress site.

The vulnerable component is the Performance Monitor WordPress plugin developed by qrolic. Versions up to and including 1.0.6 are affected, and all prior releases should be regarded as at risk. WordPress installations that have not upgraded past these releases remain vulnerable.

The vulnerability carries a CVSS base score of 7.2, indicating high severity. No EPSS data is available, and it is not listed in CISA’s known exploited vulnerabilities catalog. Because the endpoint is publicly reachable without authentication, the attack surface is large, making exploitation likely. The potential for remote code execution via SSRF chains further raises the risk profile.