CVE-2021-25084

The Advanced Cron Manager plugin versions prior to 2.4.2 lack proper authorization validation on certain AJAX functions, permitting any user with authentication privileges—including those with subscriber-level access—to invoke these actions. This vulnerability enables low-privileged users to arbitrarily create, delete, or modify cron events and their associated schedules without appropriate permission checks.

Based on public CVE data (MITRE/NVD).