{"id":"CVE-2023-22622","aliases":["BIT-wordpress-2023-22622","BIT-wordpress-multisite-2023-22622","EUVD-2023-26757","GHSA-pmh6-cq54-943m","UBUNTU-CVE-2023-22622"],"status":"published","title":"WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and...","description":"WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes \"the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner,\" but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01731,"percentile":0.77805,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-400"],"published":"2023-01-05T00:00:00Z","modified":"2026-10-28T02:30:20Z","exploits":[{"source":"pocgithub","id":"michael-david-fry/CVE-2023-22622","title":"michael-david-fry/CVE-2023-22622","date":"2024-03-20","url":"https://github.com/michael-david-fry/CVE-2023-22622"}],"fixes":[{"ecosystem":"Bitnami","package":"wordpress","fixed_in":["6.1.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"wordpress-multisite","fixed_in":["6.1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"wordpress","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.1.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"wordpress-multisite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.1.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3+dfsg-1","4.3.1+dfsg-1","4.4+dfsg-1","4.4.1+dfsg-1","4.4.2+dfsg-1","4.4.2+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.2+dfsg-2","4.8.3+dfsg-1","4.9.1+dfsg-1","4.9.2+dfsg-1","4.9.4+dfsg-1","4.9.5+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.2+dfsg1-1","5.2.4+dfsg1-1","5.3.2+dfsg1-1","5.3.2+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.1+dfsg1-2ubuntu1","5.8.1+dfsg1-2ubuntu1","5.8.2+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2+dfsg1-1ubuntu1","6.4.3+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu1","6.7.2+dfsg1-1.1ubuntu2"]}],"products":[{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"https://medium.com/%40thecpanelguy/the-nightmare-that-is-wpcron-php-ae31c1d3ae30","tags":["x_transferred","web"]},{"url":"https://www.tenable.com/plugins/was/113449","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/WordPress/WordPress/blob/dca7b5204b5fea54e6d1774689777b359a9222ab/wp-cron.php#L5-L8","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://developer.wordpress.org/plugins/cron/","tags":["x_transferred","Product","Vendor Advisory","advisory","web","report"]},{"url":"https://wordpress.org/about/security/","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://wordpress.org/support/article/how-to-install-wordpress/","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://patchstack.com/articles/solving-unpredictable-wp-cron-problems-addressing-cve-2023-22622/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22622","tags":["web","advisory"]},{"url":"https://medium.com/@thecpanelguy/the-nightmare-that-is-wpcron-php-ae31c1d3ae30","tags":["report"]},{"url":"https://developer.wordpress.org/plugins/cron"},{"url":"https://patchstack.com/articles/solving-unpredictable-wp-cron-problems-addressing-cve-2023-22622"},{"url":"https://wordpress.org/about/security"},{"url":"https://wordpress.org/support/article/how-to-install-wordpress"},{"url":"https://github.com/advisories/GHSA-pmh6-cq54-943m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22622.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-22622","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22622","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-22622","description":"WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes \"the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner,\" but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.","status":"published","published":"2023-01-05T00:00:00Z","modified":"2025-04-07T18:38:53.181Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:15.779187Z"}],"euvd":[{"id":"EUVD-2023-26757","description":"WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes \"the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner,\" but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.","status":"published","published":"2023-01-05T00:00:00Z","modified":"2025-04-07T18:38:53Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:40.600826Z"}],"ghsa":[{"id":"GHSA-pmh6-cq54-943m","title":"WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and...","description":"WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes \"the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner,\" but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.","status":"published","published":"2023-01-05T03:30:36Z","modified":"2025-04-07T21:32:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:00:50.013262Z"}],"nvd":[{"id":"CVE-2023-22622","description":"WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes \"the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner,\" but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.","status":"published","published":"2023-01-05T02:15:07.98Z","modified":"2026-06-17T05:35:45.61Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:45.305824Z"}],"osv":[{"id":"CVE-2023-22622","description":"WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes \"the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner,\" but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.","status":"published","published":"2023-01-05T00:00:00Z","modified":"2026-10-28T02:30:20.889666349Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"UBUNTU-CVE-2023-22622","description":"WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes \"the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner,\" but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.","status":"published","published":"2023-01-05T02:15:00Z","modified":"2026-10-17T12:56:03.971082964Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"BIT-wordpress-2023-22622","description":"WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes \"the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner,\" but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.","status":"published","published":"2024-03-06T11:09:23.68Z","modified":"2026-09-08T08:48:21.89182944Z","updated_at":"2026-11-02T15:28:36.455807Z"},{"id":"BIT-wordpress-multisite-2023-22622","description":"WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes \"the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner,\" but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.","status":"published","published":"2024-03-06T11:09:05.58Z","modified":"2026-09-08T08:48:21.687558395Z","updated_at":"2026-11-02T15:28:36.455807Z"}]}}