Server-Side Request Forgery Vulnerability in Performance Monitor Plugin for WordPress

CVE-2026-1648

What is CVE-2026-1648?

The Performance Monitor plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit insufficient validation of the 'url' parameter in the '/wp-json/performance-monitor/v1/curl_data' REST API endpoint. This flaw enables attackers to issue requests to arbitrary locations, potentially allowing access to sensitive internal services via the Gopher protocol and other risky protocols. If exploited alongside certain services like Redis, it could lead to remote code execution, posing a significant security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References