The qrolic Performance Monitor plugin for WordPress contains an SSRF vulnerability (CWE-918) due to improper validation of the 'url' parameter in its REST API endpoint '/wp-json/performance-monitor/v1/curl_data'. This allows unauthenticated attackers to induce the server to make arbitrary requests to internal or external resources, including via the Gopher protocol. Exploitation can lead to Remote Code Execution by leveraging vulnerable services like Redis. The vulnerability affects all versions up to and including 1.0.6 and has a CVSS 3.1 base score of 7.2 (High). No patch or remediation details are currently provided by the vendor.

An unauthenticated attacker can exploit this SSRF vulnerability to make arbitrary requests from the server, potentially accessing internal services that are not otherwise exposed. By chaining this SSRF with other vulnerable services such as Redis, an attacker may achieve Remote Code Execution. This could lead to unauthorized access, data exposure, or control over the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable REST API endpoint if possible, and monitor for unusual internal requests originating from the server. Avoid exposing internal services that could be leveraged in exploitation chains. Do not rely on generic mitigations unless specifically recommended by the vendor.