Server-side Request Forgery (SSRF) Affecting johnbillion/wp-crontrol package, versions >=1.17.0, <1.19.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PHP-JOHNBILLIONWPCRONTROL-12089396
- published21 Aug 2025
- disclosed19 Aug 2025
- creditJonas Benjamin Friedli
Introduced: 19 Aug 2025
NewCVE-2025-8678 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade johnbillion/wp-crontrol to version 1.19.2 or higher.
Overview
johnbillion/wp-crontrol is a package that allows you to take control of the cron events on your WordPress website.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the wp_remote_request function. An attacker can send arbitrary HTTP requests from the server to internal or external locations by crafting malicious cron events. This is only exploitable if the attacker has Administrator-level access.