The Qrolic Performance Monitor plugin for WordPress is affected by a critical Server-Side Request Forgery vulnerability that allows unauthenticated attackers to perform unauthorized requests against internal infrastructure.

This vulnerability occurs due to insufficient validation of the 'url' parameter within the '/wp-json/performance-monitor/v1/curl_data' REST API endpoint. An unauthenticated attacker can leverage this flaw to send requests to arbitrary locations, including internal services, using protocols such as Gopher to facilitate remote code execution.

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure. By bypassing network perimeters to interact with internal services like Redis, an attacker can escalate privileges or compromise backend systems. Given the CVSS score of 7.2, this vulnerability is classified as High severity due to the potential for significant data exposure and system compromise.

Immediate Action: As no patch version is currently identified, administrators should immediately deactivate and remove the Performance Monitor plugin from all WordPress installations until a secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs and web application firewall traffic for suspicious requests targeting the '/wp-json/performance-monitor/v1/curl_data' endpoint.

Compensating Controls: Deploy or update Web Application Firewall rules to block requests to the vulnerable API endpoint or restrict requests to known, trusted URLs if the plugin functionality is required.

Public Exploit Available: Unknown

Due to the unauthenticated nature of this vulnerability and its potential for remote code execution via internal service chaining, the risk is substantial. Organizations utilizing the Qrolic Performance Monitor plugin must treat this as a priority item and remove the software from the production environment immediately until the vendor provides a verified security update.