Server-Side Request Forgery in WP Crontrol Plugin for WordPress

CVE-2025-8678

What is CVE-2025-8678?

The WP Crontrol plugin for WordPress has a vulnerability that allows authenticated attackers with Administrator-level access to leverage the 'wp_remote_request' function for Server-Side Request Forgery. This exploitation enables these attackers to initiate web requests to arbitrary locations, which can result in unauthorized access to internal services, allowing them to query and potentially modify sensitive information.

References