{"action":"Upgrade johnbillion/wp-crontrol to 1.19.2 or later.","affected":[{"fixed":"1.19.2","introduced":"1.17.0"}],"component":"johnbillion/wp-crontrol","cve_ids":["CVE-2025-8678"],"ecosystem":"Packagist","epss":0.00363,"exploited":false,"fixed_versions":["1.19.2"],"ghsa_id":"GHSA-35c5-67fm-cpcp","id":"tcs_01M5KESMD021N6NNB7RE073NB6","modified_at":"2025-08-19T21:42:18.448849Z","published_at":"2025-08-19T20:41:10Z","references":["https://osv.dev/vulnerability/GHSA-35c5-67fm-cpcp","https://github.com/johnbillion/wp-crontrol/security/advisories/GHSA-35c5-67fm-cpcp","https://github.com/johnbillion/wp-crontrol/commit/b085bd306588d7a9baed82de37f9d1818deafc44","https://github.com/johnbillion/wp-crontrol","https://github.com/johnbillion/wp-crontrol/releases/tag/1.19.2"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-35c5-67fm-cpcp","url":"https://osv.dev/vulnerability/GHSA-35c5-67fm-cpcp"},{"source":"nvd","source_id":"CVE-2025-8678","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8678"}],"summary":"WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery"}