Medium severity5.9GHSA Advisory· Published Aug 22, 2025· Updated Apr 15, 2026
CVE-2025-8678
CVE-2025-8678
Description
The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
johnbillion/wp-crontrolPackagist | >= 1.17.0, < 1.19.2 | 1.19.2 |
Affected products
3- Range: >= 1.17.0, < 1.19.2
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-35c5-67fm-cpcpghsaADVISORY
- github.com/johnbillion/wp-crontrol/commit/b085bd306588d7a9baed82de37f9d1818deafc44ghsaWEB
- github.com/johnbillion/wp-crontrol/releases/tag/1.19.2ghsaWEB
- github.com/johnbillion/wp-crontrol/security/advisories/GHSA-35c5-67fm-cpcpghsaWEB
- plugins.trac.wordpress.org/browser/wp-crontrol/trunk/src/bootstrap.phpnvd
- plugins.trac.wordpress.org/changeset/3347075/nvd
- www.wordfence.com/threat-intel/vulnerabilities/id/ab40146d-9b49-4214-af73-41c5b5512542nvd
News mentions
0No linked articles in our index yet.