CVE-2026-3881: Unknown Performance Monitor

Medium severity, CVSS 5.8. EPSS: 0.3% chance of exploitation in the next 30 days.

The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attacks

Affected products

• Unknown Performance Monitor: up to and including 1.0.6

Published 2026-03-31. Last modified 2026-06-17.