PT-2026-44190 · Coderevolution · Crawlomatic Multipage Scraper Post Generator

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-9009

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filter content function. This is due to passing the attacker-supplied 'callback raw' shortcode attribute directly into call user func() with no sanitization or allowlist validation, relying solely on an is callable() check that permits dangerous PHP built-ins such as system, shell exec, exec, passthru, and assert. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. An identical sink exists for the 'callback' attribute, providing a second independent vector through the same shortcode.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-9009

Affected Products

Crawlomatic Multipage Scraper Post Generator

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9009 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7ff39b8f-ef87-4b1c-888e-00c9599c7b07?source=cve · Note
• https://plugins.trac.wordpress.org/browser/crawlomatic-multipage-scraper-post-generator/trunk/class.crawlomatic.shortcode.php#L273 · Note