What is CVE-2026-1648?

CVE-2026-1648 is a high-severity vulnerability in Qrolic Performance Monitor, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.2/10. Published 2026-03-21.

How severe is CVE-2026-1648?

High severity. CVSS v3 base score is 7.2 out of 10.

SSRF in Qrolic Performance Monitor

CVE-2026-1648

The Performance Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.6. This is due to insufficient validation of the 'url' parameter in the '/wp-json/performance-monitor/v1/curl_data' REST API endpoint. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations, including internal services, via the Gopher protocol and other dangerous protocols. This can be exploited to achieve Remote Code Execution by chaining with services like Redis.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.004 (30.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

Affected products

Qrolic Performance Monitor — versions 0

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

Frequently asked questions

What is CVE-2026-1648?: CVE-2026-1648 is a high-severity vulnerability in Qrolic Performance Monitor, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.2/10. Published 2026-03-21.
How severe is CVE-2026-1648?: High severity. CVSS v3 base score is 7.2 out of 10.