PT-2025-33892 · WordPress · Wp Crontrol

Jonas Benjamin Friedli · Published 2025-08-19 · Updated 2025-08-22 · CVE-2025-8678

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: WP Crontrol versions 1.17.0 through 1.19.1

Description: The WP Crontrol plugin for WordPress is vulnerable to Server-Side Request Forgery via the wp remote request() function. This allows authenticated attackers with Administrator-level access and above to make web requests to arbitrary locations originating from the web application, potentially allowing them to query and modify information from internal services.

Recommendations: WP Crontrol versions 1.17.0 through 1.19.1 should be updated to version 1.19.2 or later. If an immediate update is not possible, remove any Administrator-level users who are not fully trusted.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-8678

GHSA-35C5-67FM-CPCP

Affected Products

Wp Crontrol

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-8678 · Security Note
• https://osv.dev/vulnerability/GHSA-35c5-67fm-cpcp · Vendor Advisory
• https://github.com/johnbillion/wp-crontrol · Note
• https://github.com/johnbillion/wp-crontrol/releases/tag/1.19.2 · Note
• https://github.com/johnbillion/wp-crontrol/commit/b085bd306588d7a9baed82de37f9d1818deafc44 · Note
• https://github.com/johnbillion/wp-crontrol/security/advisories/GHSA-35c5-67fm-cpcp · Note
• https://plugins.trac.wordpress.org/changeset/3347075 · Note
• https://plugins.trac.wordpress.org/browser/wp-crontrol/trunk/src/bootstrap.php#L2712 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ab40146d-9b49-4214-af73-41c5b5512542?source=cve · Note
• https://t.me/CVEtracker/30655 · Telegram Post
• https://twitter.com/CVEnew/status/1958796802918105344 · Twitter Post