What is the CVSS score of CVE-2026-1648?

CVE-2026-1648 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Redis are affected by CVE-2026-1648?

An unauthenticated Server-Side Request Forgery vulnerability in the Performance Monitor WordPress plugin (versions ≤1.0.6) allows attackers to bypass network security controls and potentially execute…

How to fix or mitigate CVE-2026-1648?

Within 24 hours: Audit all WordPress installations to identify Performance Monitor plugin usage and version numbers; immediately disable the plugin on all affected systems. Within 7 days: Implement WAF rules to block suspicious REST API requests to the vulnerable endpoint (/wp-json/performance-monitor/*); apply network segmentation to isolate WordPress servers from sensitive internal services like Redis. Within 30 days: Remove the plugin entirely and identify suitable alternatives; assess whether any compromise occurred during the exposure window by reviewing web server and database access logs.

Redis CVE-2026-1648

EUVD-2026-14167 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-21 Wordfence

GHSA-4vr9-8jj4-gfwv

Redis WordPress SSRF RCE

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14167

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

HIGH 7.2

DescriptionCVE.org

The Performance Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.6. This is due to insufficient validation of the 'url' parameter in the '/wp-json/performance-monitor/v1/curl_data' REST API endpoint. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations, including internal services, via the Gopher protocol and other dangerous protocols. This can be exploited to achieve Remote Code Execution by chaining with services like Redis.

AnalysisAI

The Performance Monitor plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in its REST API endpoint that allows unauthenticated attackers to make arbitrary web requests to internal services using dangerous protocols including Gopher. Versions up to and including 1.0.6 are affected. This vulnerability can be chained with services like Redis to achieve Remote Code Execution, making it a critical security concern despite the 7.2 CVSS score.

Technical ContextAI

This vulnerability affects the Qrolic Performance Monitor WordPress plugin (cpe:2.3:a:qrolic:performance_monitor) and is classified as CWE-918 (Server-Side Request Forgery). The flaw exists in the '/wp-json/performance-monitor/v1/curl_data' REST API endpoint where insufficient validation of the 'url' parameter in class-rest-callback.php line 168 and class-curl.php line 50 allows attackers to manipulate the server into making requests on their behalf. The vulnerability is particularly dangerous because it supports the Gopher protocol, which can be used to interact with Redis and other internal services that lack authentication, enabling protocol smuggling attacks. The affected code makes outbound HTTP requests without properly restricting the destination or protocols, allowing access to internal network resources and potentially sensitive metadata endpoints.

RemediationAI

Immediately update the Performance Monitor plugin to a version newer than 1.0.6 that addresses this SSRF vulnerability, checking the WordPress plugin repository or vendor communications for the patched release. Until patching is possible, disable the Performance Monitor plugin entirely or implement web application firewall rules to block unauthenticated access to the '/wp-json/performance-monitor/v1/curl_data' endpoint. Network-level mitigations should include restricting outbound connections from the WordPress server to prevent access to internal services, particularly Redis and other unauthenticated internal resources. Consider implementing allowlist-based URL validation if the plugin functionality is business-critical and cannot be immediately disabled. Review server logs for suspicious requests to the vulnerable endpoint and audit internal services for any unauthorized access attempts. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f42f17-bce2-421e-9031-bfa0f8c26b2a?source=cve for additional detection and mitigation guidance.