Executive brief
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress, which is used to automatically generate website content by scraping other sources, contains a critical security flaw. This vulnerability allows an attacker with a standard author-level account to run unauthorized commands on the underlying web server. Successful exploitation could lead to a complete takeover of the website, theft of sensitive data, or the installation of malicious software.
Technical details
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution (RCE) via the 'filter_content' function in versions up to 2.7.2. The vulnerability exists because the 'callback_raw' and 'callback' shortcode attributes are passed directly into the PHP call_user_func() function without proper sanitization or allowlist validation. While the plugin performs an is_callable() check, this check is insufficient as it permits dangerous PHP built-in functions such as system(), exec(), and passthru(). An authenticated attacker with author-level permissions or higher can exploit this by crafting a shortcode that triggers these functions to execute arbitrary code on the hosting server.
Affected products
- CodeRevolution Crawlomatic Multipage Scraper Post Generator Up to and including 2.7.2
Timeline
- 2026-05-28: disclosed: Initial disclosure by Wordfence and NVD publication.