PT-2025-37127 · WordPress · Catalog Importer

Alexander Chikaylo · Published 2025-09-11 · Updated 2025-09-16 · CVE-2025-8417

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Catalog Importer, Scraper & Crawler plugin for WordPress versions through 5.1.4

Description The Catalog Importer, Scraper & Crawler plugin for WordPress is susceptible to PHP code injection due to reliance on a guessable numeric token (e.g., ?key= 900001705) without proper authentication, combined with the unsafe use of the eval() function on user-supplied input. This allows unauthenticated attackers to execute arbitrary PHP code on the server via a forged request if they can guess or brute-force the numeric key.

Recommendations Versions prior to 5.1.5 are affected. Update to a version later than 5.1.4.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-8417

Affected Products

Catalog Importer

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-8417 · Security Note
• https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L20 · Note
• https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L272 · Note
• https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L300 · Note
• https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/megaimporter.php#L57 · Note
• https://twitter.com/cracbot/status/1967906344364544270 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3eb3533c-e33c-41db-b9cf-e9d71a0a5588?source=cve · Note
• https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L244 · Note