PT-2023-18593 · WordPress · Wordpress

Published 2023-01-05 · Updated 2025-04-07 · CVE-2023-22622

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions WordPress versions through 6.1.1

Description The issue arises from WordPress's dependence on unpredictable client visits to execute wp-cron.php, which leads to security updates. The source code notes the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner. However, neither the installation guide nor the security guide mentions this default behavior or alerts the user about security risks on installations with very few visits.

Recommendations For WordPress versions through 6.1.1, consider implementing a workaround to ensure timely execution of scheduled tasks, such as manually triggering wp-cron.php or using an alternative scheduling method. As a temporary workaround, consider setting up a cron job to periodically execute wp-cron.php to minimize the risk of delayed security updates.

Fix

Related Identifiers

BIT-WORDPRESS-2023-22622

BIT-WORDPRESS-MULTISITE-2023-22622

CVE-2023-22622

Affected Products

Wordpress

References · 20

• https://developer.wordpress.org/plugins/cron · Vendor Advisory
• https://wordpress.org/support/article/how-to-install-wordpress · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22622 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22622 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22622 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-22622 · Security Note
• https://wordpress.org/about/security · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-22622 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2023-22622 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-2023-22622 · Vendor Advisory
• https://github.com/WordPress/WordPress/blob/dca7b5204b5fea54e6d1774689777b359a9222ab/wp-cron.php#L5-L8 · Note
• https://t.me/cvenotify/118090 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22622 · Note
• https://tenable.com/plugins/was/113449 · Note
• https://t.me/cvenotify/41803 · Telegram Post