CVE-2025-8678

MEDIUM 5.9 CVSS 3.1

Published: August 22, 2025
Last modified: June 17, 2026
NVD status: Deferred
Reported by: security@wordfence.com
Weakness: CWE-918
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Description

The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affected WordPress components

WP Crontrol Plugin · wp-crontrol

Confirmed match Active

From 1.17.0 (including) to 1.19.1 (including)
View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

johnbillion WP Crontrol — From 1.17.0 (including) to 1.19.1 (including)

References

plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wp-crontrol/trunk/src/bootstrap.php#L2712
plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3347075/
www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/ab40146d-9b49-4214-af73-41c5b5512542?source=cve
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected WordPress components

Affected products and versions

References