The vulnerability in the Performance Monitor WordPress plugin up to version 1.0.6 occurs because the plugin does not validate a request parameter before making an outbound HTTP request. An unauthenticated user can supply a crafted URL, causing the plugin to fetch resources on behalf of the server. The response is not returned to the attacker, making the SSRF blind, but the attacker can still force the server to contact internal or external resources, potentially exfiltrating data or triggering unauthorized actions.

WordPress sites that install the Performance Monitor plugin with a version of 1.0.6 or earlier. The plugin vendor is unknown; all installations of the affected plugin are susceptible.

The CVSS base score of 5.8 indicates moderate severity. The EPSS score is below 1 %, suggesting that real‑world exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw is exploitable without authentication and can be triggered via a simple HTTP request, administrators should regard it as a medium risk within their environment. An attacker could manipulate the server to access internal network resources or leak sensitive data through outbound requests.