Detections
Analytics

SCA: security update for johnbillion/wp-crontrol (GHSA-9xvf-cjvf-ff5q)

high Tenable Cloud Security Plugin ID 413565

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - WP Crontrol controls the cron events on WordPress websites. WP Crontrol includes a feature that allows
 administrative users to create events in the WP-Cron system that store and execute PHP code subject to the
 restrictive security permissions documented here. While there is no known vulnerability in this feature on
 its own, there exists potential for this feature to be vulnerable to RCE if it were specifically targeted
 via vulnerability chaining that exploited a separate SQLi (or similar) vulnerability. This is exploitable
 on a site if one of the below preconditions are met, the site is vulnerable to a writeable SQLi
 vulnerability in any plugin, theme, or WordPress core, the site's database is compromised at the hosting
 level, the site is vulnerable to a method of updating arbitrary options in the wp_options table, or the
 site is vulnerable to a method of triggering an arbitrary action, filter, or function with control of the
 parameters. As a hardening measure, WP Crontrol version 1.16.2 ships with a new feature that prevents
 tampering of the code stored in a PHP cron event. (CVE-2024-28850)

See Also

https://github.com/advisories/GHSA-9xvf-cjvf-ff5q

Plugin Details

Severity: High

ID: 413565

Version: Revision 1.14

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.4

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-28850

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/25/2024

Vulnerability Publication Date: 3/25/2024

Reference Information

CVE: CVE-2024-28850

cwe: CWE-494