CVE-2025-10056

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10056", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-05T19:29:56.719Z", "datePublished": "2025-10-15T08:26:03.649Z", "dateUpdated": "2026-04-08T17:25:58.619Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:58.619Z"}, "affected": [{"vendor": "miunosoft", "product": "Task Scheduler", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Task Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.3 via the \u201cCheck Website\u201d task. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "Task Scheduler <= 1.6.3 - Authenticated (Admin+) Blind Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5211437-9c6d-435f-a7f2-17ed754d0fab?source=cve"}, {"url": "https://wordpress.org/plugins/task-scheduler/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-10-14T19:39:58.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-15T13:49:04.925671Z", "id": "CVE-2025-10056", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T13:49:14.458Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10056", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-15T13:49:04.925671Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T13:49:09.780Z"}}], "cna": {"title": "Task Scheduler <= 1.6.3 - Authenticated (Admin+) Blind Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "miunosoft", "product": "Task Scheduler", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.6.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-14T19:39:58.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5211437-9c6d-435f-a7f2-17ed754d0fab?source=cve"}, {"url": "https://wordpress.org/plugins/task-scheduler/"}], "descriptions": [{"lang": "en", "value": "The Task Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.3 via the \u201cCheck Website\u201d task. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-15T08:26:03.649Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10056", "state": "PUBLISHED", "dateUpdated": "2025-10-15T13:49:14.458Z", "dateReserved": "2025-09-05T19:29:56.719Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-15T08:26:03.649Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Task Scheduler", "vendor": "miunosoft", "versions": [{"lessThanOrEqual": "1.6.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Task Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.3 via the \u201cCheck Website\u201d task. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El plugin Task Scheduler para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 1.6.3, inclusive, a trav\u00e9s de la tarea 'Check Website'. Esto hace posible que atacantes autenticados, con acceso de nivel de Administrador y superior, realicen peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede utilizarse para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2025-10056", "lastModified": "2026-10-08T12:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10056", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-15T13:49:04.925671Z", "version": "2.0.3"}}]}, "published": "2025-10-15T09:15:37.057", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/task-scheduler/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5211437-9c6d-435f-a7f2-17ed754d0fab?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:18:41.205234+00:00", "value": {"mitigation_remediation": ["Upgrade the Task Scheduler plugin to the latest version, removing the vulnerable \u201cCheck\u00a0Website\u201d feature.", "Restrict the set of administrators who can add or execute the \u201cCheck\u00a0Website\u201d tasks, limiting the attack surface for attackers who already have admin access.", "Configure the web server or network firewall to block outbound HTTP requests from the WordPress installation to internal or localhost ranges, preventing the plugin from using the SSRF channel."], "summary": {"action": "Update plugin", "impact": "Server\u2011Side Request Forgery (Blind SSRF)"}, "threat_synthesis": {"affected_systems": "The affected software is the Task Scheduler plugin developed by miunosoft for WordPress. Versions up to and including 1.6.3 are vulnerable. The issue arises from all releases prior to the 1.6.4 update, where the logic for the \u201cCheck Website\u201d task was not secured against arbitrary URLs.", "description_and_impact": "The Task Scheduler WordPress plugin contains a blind server\u2011side request forgery flaw that can be triggered via the \u201cCheck Website\u201d task. When a user with Administrator privileges or higher invokes this task, the plugin sends HTTP requests to an arbitrary host originating from the web server. The attacker can query or modify information on internal services reachable from the server, effectively turning the web application into an internal network probe.", "risk_and_exploitability": "The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog. Because the flaw requires Administrator\u2011level access, it cannot be leveraged by unauthenticated or low\u2011privilege users. The primary attack vector is an internal network request from the WordPress server, allowing reconnaissance or manipulation of internal services that are reachable from the server. Overall, the threat level is low to moderate, but patching is recommended to close the blind SSRF channel."}}}}, "created": "2025-10-21T09:41:09.026983+00:00", "updated": "2026-04-21T02:30:25.820721+00:00", "vendors": ["miunosoft", "miunosoft$PRODUCT$task_scheduler", "wordpress", "wordpress$PRODUCT$wordpress"]}