CVE-2025-10056: Task Scheduler WordPress Plugin SSRF Flaw

CVE-2025-10056 is a Server-Side Request Forgery vulnerability in the Task Scheduler WordPress plugin affecting versions up to 1.6.3. This flaw enables authenticated administrators to make unauthorized requests to internal services. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-10056 Overview

CVE-2025-10056 is a Server-Side Request Forgery (SSRF) vulnerability in the Task Scheduler plugin for WordPress. The flaw affects all plugin versions up to and including 1.6.3. It resides in the Check Website task functionality, which fails to validate user-supplied URLs before issuing outbound HTTP requests. Authenticated attackers with Administrator-level access or higher can abuse this functionality. They can direct the WordPress server to make arbitrary web requests to internal or external endpoints. The issue is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated administrators can pivot from the WordPress host to query or modify internal services that are not otherwise reachable from the public internet.

Affected Products

WordPress Task Scheduler plugin versions 1.0 through 1.6.3
WordPress sites with the plugin installed and active
Environments where the WordPress host has network reachability to internal services

Discovery Timeline

2025-10-15 - CVE-2025-10056 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10056

Vulnerability Analysis

The Task Scheduler plugin exposes a Check Website task that accepts a target URL as input. The plugin server then issues an HTTP request to that URL from the WordPress host. The plugin does not validate the destination host, scheme, or IP range before dispatching the request. This allows an authenticated Administrator to point the request at internal-only endpoints. Typical targets include cloud metadata services, internal admin panels, databases with HTTP interfaces, and loopback services. Because the request originates from the WordPress server, network access controls that trust the server's IP address are bypassed.

Root Cause

The root cause is missing validation of the URL parameter passed into the Check Website task handler. The plugin treats the URL as trusted input and passes it directly to an HTTP client. There is no allowlist of destination hosts, no denylist for private IP ranges (RFC 1918, 127.0.0.0/8, 169.254.0.0/16), and no scheme restriction to disallow file:// or gopher:// handlers where the underlying HTTP library may support them.

Attack Vector

Exploitation requires an authenticated session with Administrator privileges. The attacker configures or triggers a Check Website task with a URL pointing to an internal resource. The WordPress server issues the request and, depending on the response handling, may return response data to the attacker or perform state-changing operations on the target service. Common targets include the AWS Instance Metadata Service at http://169.254.254, internal Redis or Elasticsearch instances, and localhost administrative interfaces.

No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-10056

Indicators of Compromise

Outbound HTTP requests from the WordPress host to private IP ranges or 169.254.254
WordPress access log entries showing administrator interactions with Task Scheduler endpoints followed by unusual egress traffic
Unexpected Check Website task definitions in the plugin's configuration referencing internal hostnames or IP addresses

Detection Strategies

Inspect the Task Scheduler plugin database entries for scheduled tasks with URLs pointing to RFC 1918 addresses, localhost, or cloud metadata endpoints
Correlate WordPress administrator authentication events with outbound network flows from the web server to internal subnets
Monitor web server process network activity for connections to services the WordPress host should not normally contact

Monitoring Recommendations

Alert on any outbound connection from the WordPress host to 169.254.254, 127.0.0.1 non-standard ports, or internal management VLANs
Log all administrative changes to Task Scheduler plugin configuration and retain them for review
Baseline normal outbound traffic from web application servers and flag deviations

How to Mitigate CVE-2025-10056

Immediate Actions Required

Update the Task Scheduler plugin to a version above 1.6.3 once the vendor releases a patched release
Audit existing Administrator accounts and remove any that are not required
Review all scheduled Check Website tasks and remove entries referencing internal or metadata endpoints

Patch Information

At the time of publication, no fixed version is listed beyond 1.6.3 in the referenced advisory. Monitor the WordPress Task Scheduler Plugin page and the Wordfence Vulnerability Report for a patched release.

Workarounds

Deactivate the Task Scheduler plugin until a fixed version is available
Restrict outbound network access from the WordPress host using egress firewall rules that deny traffic to internal subnets and cloud metadata addresses
Enforce Instance Metadata Service Version 2 (IMDSv2) on AWS-hosted WordPress instances to require session tokens for metadata access
Limit Administrator role assignment and enforce multi-factor authentication for all privileged WordPress accounts

bash

# Example egress restriction using iptables on the WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp -j DROP