Performance Monitor
Monthly
The Performance Monitor plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in its REST API endpoint that allows unauthenticated attackers to make arbitrary web requests to internal services using dangerous protocols including Gopher. Versions up to and including 1.0.6 are affected. This vulnerability can be chained with services like Redis to achieve Remote Code Execution, making it a critical security concern despite the 7.2 CVSS score.
Unauthenticated Server-Side Request Forgery (SSRF) in Performance Monitor WordPress plugin through version 1.0.6 allows remote attackers to perform arbitrary HTTP requests by exploiting insufficient parameter validation. The vulnerability enables attackers without authentication to interact with internal network resources and services accessible from the WordPress server, potentially leading to information disclosure, lateral movement, or interaction with backend systems.
The Performance Monitor plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in its REST API endpoint that allows unauthenticated attackers to make arbitrary web requests to internal services using dangerous protocols including Gopher. Versions up to and including 1.0.6 are affected. This vulnerability can be chained with services like Redis to achieve Remote Code Execution, making it a critical security concern despite the 7.2 CVSS score.
Unauthenticated Server-Side Request Forgery (SSRF) in Performance Monitor WordPress plugin through version 1.0.6 allows remote attackers to perform arbitrary HTTP requests by exploiting insufficient parameter validation. The vulnerability enables attackers without authentication to interact with internal network resources and services accessible from the WordPress server, potentially leading to information disclosure, lateral movement, or interaction with backend systems.