Packagist/johnbillion/wp-crontrol CVE-2025-8678: medium 5.9, EPSS 0.36%

WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery

Action: Upgrade johnbillion/wp-crontrol to 1.19.2 or later.

composer require johnbillion/wp-crontrol:1.19.2

Affected

Fixed versions

Sources

• osv: GHSA-35c5-67fm-cpcp
• nvd: CVE-2025-8678
• https://github.com/johnbillion/wp-crontrol/security/advisories/GHSA-35c5-67fm-cpcp
• https://github.com/johnbillion/wp-crontrol/commit/b085bd306588d7a9baed82de37f9d1818deafc44
• https://github.com/johnbillion/wp-crontrol
• https://github.com/johnbillion/wp-crontrol/releases/tag/1.19.2

CVE-2025-8678 · published 2025-08-19T20:41:10Z · modified 2025-08-19T21:42:18.448849Z · JSON