CVE-2026-1648 | qrolic Performance Monitor Plugin up to 1.0.6 on WordPress REST API Endpoint curl_data url server-side request forgery

A vulnerability classified as critical has been found in qrolic Performance Monitor Plugin up to 1.0.6 on WordPress. Affected by this issue is some unknown functionality of the file /wp-json/performance-monitor/v1/curl_data of the component REST API Endpoint. Performing a manipulation of the argument url results in server-side request forgery.

This vulnerability is known as CVE-2026-1648. Remote exploitation of the attack is possible. No exploit is available.

It is recommended to upgrade the affected component.