WP Crontrol
WP Crontrol has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2025; all 3 are fixed as of October 2026. Their average CVSS score is 6.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Scripting, behind 1 of the records (33%). Other recurring categories include Download Of Code Without Integrity Check, Server-Side Request Forgery (SSRF).
Every one of the 3 issues recorded for WP Crontrol has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. WP Crontrol is installed on roughly 300,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2024-28850WP Crontrol <= 1.16.1 - Remote Code Execution
Read the full analysisVulnerability Records

WP Crontrol
Author
Syed Balkhi
Take control of the cron events on your WordPress website or WooCommerce store with WP Crontrol. From the admin screens you can: View all scheduled cron events along with their arguments, schedule, callback functions, and when they are next due. Log each run of the events you choose, with its duration, errors, HTTP requests, and emails sent. Get an email when a logged event fails. Let an AI assistant check, run, and pause cron events and read their logs, through the WordPress Abilities API (WordPress 6.9 and later). Edit, delete, pause, resume, and immediately run cron events. Add new cron events. Bulk delete cron events. Add and remove custom cron schedules. Export and download cron event lists as a CSV file. WP Crontrol is aware of timezones, will alert you to events that have no actions or that have missed their schedule, and will show you a helpful warning message if it detects any problems with your cron system. Usage Go to the Cron → Cron Events menu to manage cron events. Tools → Cron Events still works too. Go to the Cron → Cron Logs menu to see what ran, once you turn on logging for an event. Go to the Cron → Cron Insights menu to see how your events behaved over the last week. Go to the Cron → Cron Alerts menu to get an email when a logged event fails. Go to the Cron → Cron AI menu to see what an AI assistant can do with your cron events. Go to the Cron → Cron Schedules menu to manage cron schedules. Documentation Extensive documentation on how to use WP Crontrol and how to get help for error messages that it shows is available on the WP Crontrol website. For site owners Owners of WordPress websites and WooCommerce stores use WP Crontrol to ensure that scheduled cron events run correctly and efficiently. By providing complete control over cron events, WP Crontrol helps you: Improve reliability: Address missed or failed cron events, ensuring your website or WooCommerce store continues to function as expected. Enhance security: Monitor and control cron events to ensure automatic update checks are performed as they should. Simplify management: Add, edit, delete, and pause cron events from a user-friendly interface, without needing to write any code. Gain insights: Export cron event data for analysis or reporting. Action Scheduler compatibility: Full support for the Action Scheduler system in WooCommerce, which is used to process recurring payments, subscriptions, and background orders. Clarity of times and timezones: All times are shown with a clear and accurate indication of which timezone applies. No more guesswork! For developers Developers use WP Crontrol to streamline and debug their WordPress development process: Enhanced debugging: Identify and troubleshoot issues with scheduled tasks, ensuring your scheduled events and their callbacks run as expected. Custom schedules: Create and manage custom cron schedules to fit the specific needs of your website, plugins, or themes, providing greater flexibility than just the core schedules. Efficient workflow: Add, edit, and delete cron events directly from the WordPress admin interface, saving time and reducing the need for manual coding. Insightful monitoring: Get insight into the performance and behavior of your scheduled tasks, allowing for optimization and better resource management. Accurate debugging: WP Crontrol goes to great lengths to ensure that running an event manually does so in a manner which exactly matches how WordPress core runs schdeuled events. This ensures that you can debug events accurately and with confidence. Other Plugins WP Crontrol was built by John Blackbourn, who also maintains these plugins for developers: Query Monitor is the developer tools panel for WordPress. User Switching provides instant switching between user accounts in WordPress. More Plugins From Our Team WP Crontrol is now looked after by the Duplicator team. If it’s useful to you, these might be too: WPVibe connects AI assistants like Claude and ChatGPT to your WordPress site, so they can build and manage it for you. Duplicator backs up, migrates, and clones WordPress sites. WP Mail SMTP fixes WordPress email delivery, so the emails your scheduled tasks send actually arrive. WPCode adds custom code snippets to WordPress safely, without editing your theme’s functions.php file. Privacy Statement WP Crontrol is private by default and always will be. It does not send data to any third party, nor does it include any third party resources. WP Crontrol’s full privacy statement can be found here. Cron alerts are sent by your site’s own email setup, only to the addresses you choose. When you install or activate one of our other plugins from a WP Crontrol screen, WP Crontrol notes which one in your site’s database, so you can see what came from WP Crontrol. That note stays on your site and is never sent anywhere. Accessibility Statement WP Crontrol aims to be fully accessible to all of its users. WP Crontrol’s full accessibility statement can be found here. Legal Crontrol® is a registered trademark of Clever Things For The Web Limited.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C