PT-2025-42281 · WordPress · Wordpress Task Scheduler

Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-10056

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Task Scheduler plugin versions prior to 1.6.4

Description The Task Scheduler plugin for WordPress is susceptible to Server-Side Request Forgery. This affects authenticated attackers with Administrator-level access or higher. Attackers can leverage the “Check Website” task to make web requests to arbitrary locations from the web application. This can potentially allow querying and modification of information from internal services.

Recommendations Update the Task Scheduler plugin to version 1.6.4 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-10056

Affected Products

Wordpress Task Scheduler

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10056 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d5211437-9c6d-435f-a7f2-17ed754d0fab?source=cve · Note
• https://wordpress.org/plugins/task-scheduler · Note
• https://twitter.com/CVEnew/status/1978545107151556622 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978491812814672052 · Twitter Post
• https://t.me/cveNotify/138722 · Telegram Post