WordPress Task Scheduler CVE-2025-10056

Requires an authenticated session with Administrator-level privileges (or higher) on the target WordPress site, consistent with PR:H in the CVSS vector. The specific vulnerable feature is the plugin's 'Check Website' task, which must be used to supply an attacker-chosen URL/host; the SSRF only yields value when the WordPress server has network paths to internal services (metadata endpoints, internal APIs, databases) that are not externally reachable. The admin requirement is the primary limiting factor and makes widespread opportunistic exploitation unlikely; affects all versions up to and including 1.6.3.

This is a low-priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N, base 4.4 MEDIUM) hinges on PR:H - exploitation requires existing Administrator-level access to the WordPress site, which is the single strongest mitigating signal: an attacker who already holds admin can typically pivot through many other avenues (plugin/theme file editing, PHP execution), so the marginal risk added by this SSRF is limited. Exploitation signals are weak and mutually consistent: EPSS is 0.24% (14th percentile), there is no CISA KEV listing, and no public proof-of-concept is referenced - so no public exploit identified at time of analysis. One internal inconsistency worth noting: the input vector sets AC:H, but the description portrays a straightforward abuse of the 'Check Website' task feature with no special timing/race conditions, so AC:L is arguably more accurate - this disagreement does not change the overall LOW real-world priority given the admin precondition. The scope change (S:C) and CWE-918 correctly reflect that impact lands on internal/back-end services rather than the WordPress app itself.

An attacker who has already obtained Administrator access to a WordPress site (e.g., via compromised credentials or a rogue admin account) configures the Task Scheduler 'Check Website' task to point at an internal address such as a cloud metadata endpoint or an internal admin API. The plugin issues the request from the server, allowing the attacker to query and modify internal services not otherwise reachable from the internet. No public exploit identified at time of analysis, so this would require manual abuse of the feature.