CVE-2025-8678: WP Crontrol Plugin Vulnerable to Blind Server-Side Request Forgery
Summary
CVE-2025-8678: WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery. Affects johnbillion/wp-crontrol versions >= 1.17.0, < 1.19.2. Fixed in 1.19.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WP Crontrol is a WordPress plugin that allows users to manage and control cron events in their WordPress installations. It provides features for scheduling, editing, and deleting cron jobs, making it easier for developers and site administrators to manage automated tasks. However, versions 1.17.0 to 1.19.1 of the plugin are susceptible to a Blind Server-Side Request Forgery (SSRF) vulnerability, which can be exploited by authenticated users with Administrator-level access.
Vulnerability Detail
The vulnerability arises from the use of the wp_remote_request() function, which allows authenticated attackers to send web requests to arbitrary locations. This can lead to unauthorized access to internal services and data. Importantly, the attacker cannot see or time the HTTP response, limiting the exploit's effectiveness. The flaw is classified under CWE-918, indicating a weakness in the handling of server-side requests.
How To Fix
Minimum fixed version
1.19.2
This is the first release that contains the fix.
composer require johnbillion/wp-crontrol:1.19.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to remove any untrusted Administrator-level users from your WordPress site to mitigate the risk of exploitation.
Conclusion
The WP Crontrol plugin has a significant vulnerability that could be exploited by authenticated users with Administrator access. It is crucial to update to the patched version 1.19.2 to mitigate this risk. If immediate updates are not feasible, consider removing untrusted Administrator users as a temporary measure.
See every vulnerability recorded for johnbillion/wp-crontrol →
FAQ
Your site is at risk only if an untrustworthy Administrator exploits this vulnerability to send HTTP requests to external or internal URLs.
An attacker could potentially access internal services and data, leading to unauthorized information disclosure or manipulation.
No, only users with Administrator-level access can exploit this vulnerability.
The plugin has built-in anti-tampering measures that prevent database-level attackers from modifying URL cron events.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the composer.lock file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for johnbillion/wp-crontrol.
