CodeRevolution Crawlomatic Multipage Scraper Post Generator Plugin call_user_func unrestricted upload

Summaryinfo

A vulnerability, which was classified as critical, has been found in CodeRevolution Crawlomatic Multipage Scraper Post Generator Plugin up to 2.7.2 on WordPress. This affects the function call_user_func. This manipulation of the argument callback_raw causes unrestricted upload. This vulnerability is tracked as CVE-2026-9009. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in CodeRevolution Crawlomatic Multipage Scraper Post Generator Plugin up to 2.7.2 on WordPress. It has been declared as critical. Affected by this vulnerability is the function call_user_func. The manipulation of the argument callback_raw with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filter_content function. This is due to passing the attacker-supplied 'callback_raw' shortcode attribute directly into call_user_func() with no sanitization or allowlist validation, relying solely on an is_callable() check that permits dangerous PHP built-ins such as system, shell_exec, exec, passthru, and assert. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. An identical sink exists for the 'callback' attribute, providing a second independent vector through the same shortcode.

The weakness was disclosed by Nguyen Ngoc Duc. The advisory is shared at wordfence.com. This vulnerability is known as CVE-2026-9009 since 05/19/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/28/2026). MITRE ATT&CK project uses the attack technique T1608.002 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-32723). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• CodeRevolution

Name

• Crawlomatic Multipage Scraper Post Generator Plugin

Version

• 2.7.0
• 2.7.1
• 2.7.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion