CVE-2023-22622

WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.

• https://developer.wordpress.org/plugins/cron/Product, Vendor Advisory
• https://github.com/WordPress/WordPress/blob/dca7b5204b5fea54e6d1774689777b359a9222ab/wp-cron.php#L5-L8Third Party Advisory
• https://medium.com/%40thecpanelguy/the-nightmare-that-is-wpcron-php-ae31c1d3ae30
• https://patchstack.com/articles/solving-unpredictable-wp-cron-problems-addressing-cve-2023-22622/Third Party Advisory
• https://wordpress.org/about/security/Vendor Advisory
• https://wordpress.org/support/article/how-to-install-wordpress/Vendor Advisory
• https://www.tenable.com/plugins/was/113449Third Party Advisory
• https://developer.wordpress.org/plugins/cron/Product, Vendor Advisory
• https://github.com/WordPress/WordPress/blob/dca7b5204b5fea54e6d1774689777b359a9222ab/wp-cron.php#L5-L8Third Party Advisory
• https://medium.com/%40thecpanelguy/the-nightmare-that-is-wpcron-php-ae31c1d3ae30
• https://patchstack.com/articles/solving-unpredictable-wp-cron-problems-addressing-cve-2023-22622/Third Party Advisory
• https://wordpress.org/about/security/Vendor Advisory
• https://wordpress.org/support/article/how-to-install-wordpress/Vendor Advisory
• https://www.tenable.com/plugins/was/113449Third Party Advisory

Published

Jan 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22616An issue was discovered in Insyde InsydeH2O with kernel 5.2 …7.8
• CVE-2023-22617A remote attacker might be able to cause infinite recursion …7.5
• CVE-2023-22618If Security Hardening guide rules are not followed, then Nok…7.8
• CVE-2023-2262 A buffer overflow vulnerability exists in the Rockwell Au…9.8
• CVE-2023-22620An issue was discovered in SecurePoint UTM before 12.2.5.1. …7.5
• CVE-2023-22621Strapi through 4.5.5 allows authenticated Server-Side Templa…7.2
• CVE-2023-22624Zoho ManageEngine Exchange Reporter Plus before 5708 allows …7.5
• CVE-2023-22626PgHero before 3.1.0 allows Information Disclosure via EXPLAI…7.5
• CVE-2023-22629An issue was discovered in TitanFTP through 1.94.1205. The m…8.8
• CVE-2023-2263 The Rockwell Automation Kinetix 5700 DC Bus Power Supply Se…7.5
• CVE-2023-22630IzyBat Orange casiers before 20221102_1 allows SQL Injection…4.3
• CVE-2023-22633An improper permissions, privileges, and access controls vul…7.5