Vulnerability Fixation
WordPress wp-corn.php

WordPress wp-corn.php Vulnerability

A common vulnerability that can arise in WordPress installations is related to the `wp-cron.php` file. If left enabled and improperly configured, it can expose your site to Distributed Denial of Service (DDoS) or Denial of Service (DoS) attacks. `wp-cron.php` is WordPress’s built-in pseudo-cron system that handles scheduled tasks like:

  • Publishing scheduled posts - Checking for plugin, theme and core updates.
  • Sending email notifications.
  • Running automated maintenance tasks Unlike traditional cron jobs, which are scheduled and executed by the server's operating system, `wp-cron.php` runs whenever a page is loaded on the WordPress site.
  • This means every visitor triggers the file, making it resource-intensive during high-traffic periods.
Vulnerability

  • Since wp-cron.php runs on every page load, attackers can flood it with requests, consuming CPU and memory resources.
  • This leads to performance degradation or complete site unavailability.
Impact

  • Site slowdown or complete downtime.
  • High server load and resource exhaustion.
  • Increased hosting and operational costs.
Solution

  • Disable default cron: Add define('DISABLE_WP_CRON', true); in wp-config.php.
  • Use server cron job: Schedule it to run every 15 minutes using system cron.
  • Apply rate limiting: Restrict repeated requests to /wp-cron.php.
  • Restrict access: Allow only trusted IPs (e.g., localhost).

Also Read :