PT-2023-18593 · WordPress · Wordpress

CVE-2023-22622 · Publicado 2023-01-05 · Atualizado 2025-04-07

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions WordPress versions through 6.1.1

Description The issue arises from WordPress's dependence on unpredictable client visits to execute wp-cron.php, which leads to security updates. The source code notes the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner. However, neither the installation guide nor the security guide mentions this default behavior or alerts the user about security risks on installations with very few visits.

Recommendations For WordPress versions through 6.1.1, consider implementing a workaround to ensure timely execution of scheduled tasks, such as manually triggering wp-cron.php or using an alternative scheduling method. As a temporary workaround, consider setting up a cron job to periodically execute wp-cron.php to minimize the risk of delayed security updates.

Exploit

Correção

Identificadores relacionados

BIT-WORDPRESS-2023-22622

BIT-WORDPRESS-MULTISITE-2023-22622

CVE-2023-22622

Produtos afetados

Wordpress

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22622.json · Exploit
• https://github.com/WordPress/WordPress/blob/dca7b5204b5fea54e6d1774689777b359a9222ab/wp-cron.php#L5-L8 · Nota
• https://wordpress.org/support/article/how-to-install-wordpress · Aviso do Fabricante
• https://developer.wordpress.org/plugins/cron · Aviso do Fabricante
• https://t.me/cvenotify/43473 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2023-22622 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-22622 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-22622 · Aviso do Fabricante
• https://medium.com/@thecpanelguy/the-nightmare-that-is-wpcron-php-ae31c1d3ae30 · Nota
• https://tenable.com/plugins/was/113449 · Nota
• https://t.me/cvenotify/41803 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-22622 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22622 · Aviso do Fabricante
• https://medium.com/%40thecpanelguy/the-nightmare-that-is-wpcron-php-ae31c1d3ae30 · Nota
• https://wordpress.org/about/security · Aviso do Fabricante