CVE-2023-22622

Deeper analysis

WordPress through version 6.1.1 relies on unpredictable client visits to trigger execution of wp-cron.php, which in turn handles scheduled security updates and other tasks. The wp-cron.php source code itself acknowledges the risk that low-traffic sites may not execute these tasks promptly, yet neither the installation guide nor the security documentation warns administrators about this default behavior or the resulting exposure on installations that receive few visits.

An attacker positioned on an adjacent network can leverage the high-complexity conditions described in the CVSS vector to interfere with cron execution, resulting in high impact to availability while requiring no privileges or user interaction. This leaves affected sites without timely security updates or other scheduled maintenance when visit volume is insufficient to drive wp-cron.php.

Advisories and references, including the Patchstack article on solving unpredictable wp-cron problems and the official WordPress security page, point to replacing the default visit-triggered mechanism with a system cron job or equivalent external scheduler to ensure reliable execution regardless of traffic levels. The associated EPSS score reached a peak of 0.1026 before receding to its current value of 0.0842, indicating modest post-disclosure interest that has since declined.