Every CVE Search/ Get API key

CVE-2023-22622

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and...

5.3 MediumPublic exploitFix available

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.73%Unchanged since Jan 5, 2023
90%50%10%1%

What each source reports

NVD Score used 5.3

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.

Record
CVE-2023-22622
CVSS 3.1
5.3 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
CVE List 5.3

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.

Record
CVE-2023-22622
CVSS 3.1
5.3 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
EUVDEUVD-2023-26757 5.3

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.

Record
EUVD-2023-26757
CVSS 3.1
5.3 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-pmh6-cq54-943m 7.5

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and...

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.

Record
GHSA-pmh6-cq54-943m
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSV 5.3

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.

Record
CVE-2023-22622
CVSS 3.1
5.3 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-22622 5.3

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.

Record
UBUNTU-CVE-2023-22622
CVSS 3.1
5.3 MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-wordpress-2023-22622 No score

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.

Record
BIT-wordpress-2023-22622
Updated
2026-11-02
OSVBIT-wordpress-multisite-2023-22622 No score

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.

Record
BIT-wordpress-multisite-2023-22622
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wordpress
Bitnami
before 6.1.2
6.1.2
wordpress-multisite
Bitnami
before 6.1.2
6.1.2
wordpress
Ubuntu:16.04:LTS
All versions, plus listed versions
4.3+dfsg-14.3.1+dfsg-14.4+dfsg-14.4.1+dfsg-14.4.2+dfsg-14.4.2+dfsg-1ubuntu1
None known
wordpress
Ubuntu:18.04:LTS
All versions, plus listed versions
4.8.2+dfsg-24.8.3+dfsg-14.9.1+dfsg-14.9.2+dfsg-14.9.4+dfsg-14.9.5+dfsg1-1
None known
wordpress
Ubuntu:20.04:LTS
All versions, plus listed versions
5.2.2+dfsg1-15.2.4+dfsg1-15.3.2+dfsg1-15.3.2+dfsg1-1ubuntu1
None known
wordpress
Ubuntu:22.04:LTS
All versions, plus listed versions
5.7.1+dfsg1-2ubuntu15.8.1+dfsg1-2ubuntu15.8.2+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu1.1
None known
wordpress
Ubuntu:24.04:LTS
All versions, plus listed versions
6.2+dfsg1-1ubuntu16.4.3+dfsg1-1ubuntu1
None known
wordpress
Ubuntu:25.10
All versions, plus listed versions
6.7.2+dfsg1-1.1ubuntu1
None known
wordpress
Ubuntu:26.10
All versions, plus listed versions
6.7.2+dfsg1-1.1ubuntu2
None known
wordpress
Ubuntu:26.04:LTS
All versions, plus listed versions
6.7.2+dfsg1-1.1ubuntu16.7.2+dfsg1-1.1ubuntu2
None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubmichael-david-fry/CVE-2023-226222024-03-20

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-22622 is a medium vulnerability (CVSS 5.3) in Wordpress, published January 5, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.73%, the 77th percentile. Fixed in wordpress 6.1.2.

References

Show 7 moreShow less
MoveEnter Open