Performance Monitor WordPress Plugin Unauthenticated Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the Performance Monitor WordPress plugin, affecting versions through 1.0.6. The vulnerability arises because the plugin does not properly validate a parameter before making a request, allowing unauthenticated users to exploit this oversight.

Impact

Exploitation of this vulnerability could lead to unauthorized server-side request forgery, allowing attackers to make requests from the server to internal resources or external services.

Reproduction

To reproduce this vulnerability, send a request to the WordPress site's REST API endpoint for the Performance Monitor plugin, specifically the 'curl_data' route. Include a 'url' parameter with a value that points to an internal resource or service, such as 'http://127.0.0.1:8282'.