CVE-2026-3881

Performance Monitor <= 1.0.6 - Unauthenticated Blind SSRF

CVSS 5.8 MEDIUMEPSS 0.3%CWE-918

The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attacks

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Affected products

Unknown · Performance Monitor

public PoCs found — 1

cve_referencewpscan.com/vulnerability/4b30421e-9848-45ce-87ab-0229d9d7df01/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://wpscan.com/vulnerability/4b30421e-9848-45ce-87ab-0229d9d7df01/