CVE-2026-1648: 
WordPress vulnerability analysis and mitigation

CVE-2026-1648 is a Server-Side Request Forgery (SSRF) vulnerability in the Performance Monitor plugin for WordPress, developed by Qrolic. It affects all versions up to and including 1.0.6, and allows unauthenticated attackers to make arbitrary web requests — including to internal services — via the Gopher protocol and other dangerous protocols. The vulnerability was published on March 21, 2026, and assigned a CVSS v3.1 base score of 7.2 (High) (Feedly, Wordfence).

The root cause is insufficient validation of the url parameter in the /wp-json/performance-monitor/v1/curl_data REST API endpoint (CWE-918: Server-Side Request Forgery). Because this endpoint is publicly accessible without authentication, any remote attacker can supply an arbitrary URL — including those using the gopher:// scheme — causing the server to issue requests on the attacker's behalf to internal network resources. The vulnerability can be chained with internally accessible services such as Redis to escalate impact to Remote Code Execution (RCE), for example by using Gopher-based payloads to write malicious cron jobs or web shells via Redis (Wordfence, blind-ssrf-chains). The vulnerable code paths are visible in the plugin source at includes/class-rest-callback.php#L168 and admin/class-curl.php#L50 (Wordfence).

Successful exploitation allows unauthenticated attackers to probe and interact with internal services not normally reachable from the internet, resulting in low confidentiality and integrity impacts at a minimum (CVSS scope: Changed). When chained with services like Redis via the Gopher protocol, attackers can escalate to full Remote Code Execution on the underlying server, enabling data exfiltration, web shell deployment, or lateral movement within the internal network (Feedly, blind-ssrf-chains).

No public exploit code or active in-the-wild exploitation has been confirmed at this time. The EPSS score is approximately 0.039%, indicating a currently low probability of exploitation in the near term (Feedly). The vulnerability is unauthenticated and network-accessible with low attack complexity, making it straightforward to exploit if an attacker identifies a vulnerable installation. There is no indication this CVE has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the available data.

1. Reconnaissance: Identify WordPress sites running the Performance Monitor plugin (version ≤ 1.0.6) using tools like WPScan, Shodan, or by checking /wp-content/plugins/performance-monitor/ for plugin presence.
2. Confirm endpoint availability: Send a GET or POST request to /wp-json/performance-monitor/v1/curl_data to verify the REST API endpoint is accessible without authentication.
3. Probe internal network: Supply a crafted url parameter pointing to internal services (e.g., url=http://127.0.0.1:6379/) to enumerate open ports and services on the internal network, using response timing or status codes as side-channel indicators.
4. Identify Redis or other exploitable services: Confirm the presence of Redis (default port 6379) or other Gopher-exploitable services (Memcache, FastCGI) on the internal network.
5. Craft Gopher payload for RCE: Use a tool like Gopherus to generate a Gopher payload targeting Redis, e.g., to write a cron job: gopher://127.0.0.1:6379/_*1%0d%0a$8%0d%0aflushall%0d%0a... that schedules a reverse shell.
6. Send malicious request: Submit the Gopher payload as the url parameter to the vulnerable endpoint: POST /wp-json/performance-monitor/v1/curl_data with body url=gopher://127.0.0.1:6379/_<encoded_payload>.
7. Achieve RCE: The Redis cron job or web shell executes, granting the attacker a shell on the server as the web server user (blind-ssrf-chains, Wordfence).

• Network: Unusual outbound or internal HTTP/Gopher requests originating from the WordPress web server process; connections from the web server to internal ports such as 6379 (Redis), 11211 (Memcache), or 9000 (FastCGI).
• Logs: WordPress or web server access logs showing repeated POST or GET requests to /wp-json/performance-monitor/v1/curl_data with suspicious url parameter values (e.g., gopher://, dict://, file://, or internal IP addresses such as 127.0.0.1 or RFC-1918 ranges).
• File System: Unexpected PHP web shells or new files in the WordPress installation directory or /var/www/; new or modified cron jobs in /var/spool/cron/ or /etc/cron.d/ created by the web server user.
• Process: Unusual child processes spawned by the web server (e.g., bash, curl, wget, nc) or unexpected outbound network connections from the web server process.

Users should update the Performance Monitor plugin to a version beyond 1.0.6 as soon as a patched release is made available by the vendor (Qrolic). In the interim, administrators should consider deactivating or removing the plugin entirely to eliminate the attack surface. Additionally, network-level controls should be applied to restrict the web server's ability to make outbound connections to internal services (e.g., Redis, Memcache), and the Gopher protocol should be disabled at the server or firewall level where possible (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for the week of March 16–22, 2026, and assigned it a High severity rating (Wordfence Blog). RedPacket Security flagged the CVE in their automated alert feed, and it was noted on social media (Mastodon/infosec.exchange) shortly after disclosure (Feedly). No major vendor statements or significant researcher commentary beyond initial disclosure have been identified.