Vulnerability · Published Mar 31, 2026 · Assigned by WPScan

CVE-2026-3881Performance Monitor <= 1.0.6 - Unauthenticated Blind SSRF

Medium 5.8

In plain English

A medium-severity server-side request forgery in Performance Monitor from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.3%top 81.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attacks

Affected products (as reported)

Vendor	Product	Versions
Unknown	Performance Monitor	0 – through 1.0.6

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/4b30421e-9848-45ce-87ab-0229d9d7df01/ exploit, vdb-entry, technical-description