Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion
Priority LOW 21CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for example
Why it matters now
EPSS 0.0065 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Advanced Cron Manager (Unknown): 2.4.2Advanced Cron Manager Pro (Unknown): 2.5.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Advanced Cron Manager | 2.4.2 to before 2.4.2 | 2.4.2 | Patch available | CNA |
| Unknown | Advanced Cron Manager Pro | 2.5.3 to before 2.5.3 | 2.5.3 | Patch available | CNA |
- Advanced Cron Manager VendorUnknown Affected 2.4.2 to before 2.4.2 Fixed in 2.4.2 Patch available CNA
- Advanced Cron Manager Pro VendorUnknown Affected 2.5.3 to before 2.5.3 Fixed in 2.5.3 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bracketspace:advanced_cron_manager:*:*:*:*:-:wordpress:*:* | before 2.4.2 | Vulnerable | BracketSpace |
| cpe:2.3:a:bracketspace:advanced_cron_manager:*:*:*:*:pro:wordpress:*:* | before 2.5.3 | Vulnerable | BracketSpace |
- cpe:2.3:a:bracketspace:advanced_cron_manager:*:*:*:*:-:wordpress:*:* Versions before 2.4.2 Vulnerable ·BracketSpace
- cpe:2.3:a:bracketspace:advanced_cron_manager:*:*:*:*:pro:wordpress:*:* Versions before 2.5.3 Vulnerable ·BracketSpace
Remediation
- Fix · CNA Advanced Cron Manager (Unknown) Fixed in 2.4.2
- Fix · CNA Advanced Cron Manager Pro (Unknown) Fixed in 2.5.3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25084
- 2026-10-03 Alias added: GHSA-rggm-wjvh-78r5
- 2026-10-16 EPSS moved to the 50th–90th percentile
References
More BracketSpace Advanced Cron Manager vulnerabilities
- TI-2024-03736 Advanced Cron Manager < 2.5.7 - Admin+ Stored XSS CVSS 3.1LOW 3.5
Sources
- CVE-2021-25084 · CVE Program
- CVE-2021-25084 · NVD
- FIRST EPSS
- GHSA-rggm-wjvh-78r5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences