{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-4389", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-06T19:26:11.492Z", "datePublished": "2025-05-17T05:30:33.140Z", "dateUpdated": "2026-04-08T16:36:26.068Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:26.068Z"}, "affected": [{"vendor": "CodeRevolution", "product": "Crawlomatic Multipage Scraper Post Generator", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.6.8.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlomatic_generate_featured_image() function in all versions up to, and including, 2.6.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1283e839-8588-4a76-9c1e-61562526166d?source=cve"}, {"url": "https://codecanyon.net/item/crawlomatic-multisite-scraper-post-generator-plugin-for-wordpress/20476010"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "timeline": [{"time": "2025-05-16T16:29:47.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-19T16:58:52.991409Z", "id": "CVE-2025-4389", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-19T16:58:58.435Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4389", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-19T16:58:52.991409Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-19T16:58:55.710Z"}}], "cna": {"title": "Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "CodeRevolution", "product": "Crawlomatic Multipage Scraper Post Generator", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.6.8.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-16T16:29:47.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1283e839-8588-4a76-9c1e-61562526166d?source=cve"}, {"url": "https://codecanyon.net/item/crawlomatic-multisite-scraper-post-generator-plugin-for-wordpress/20476010"}], "descriptions": [{"lang": "en", "value": "The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlomatic_generate_featured_image() function in all versions up to, and including, 2.6.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:26.068Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4389", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:36:26.068Z", "dateReserved": "2025-05-06T19:26:11.492Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-17T05:30:33.140Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlomatic_generate_featured_image() function in all versions up to, and including, 2.6.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El complemento Crawlomatic Multipage Scraper Post Generator para WordPress es vulnerable a la carga de archivos arbitrarios debido a la falta de validaci\u00f3n del tipo de archivo en la funci\u00f3n crawlomatic_generate_featured_image() en todas las versiones hasta la 2.6.8.1 incluida. Esto permite que atacantes no autenticados carguen archivos arbitrarios en el servidor del sitio afectado, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-4389", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-05-17T06:15:18.980", "references": [{"source": "security@wordfence.com", "url": "https://codecanyon.net/item/crawlomatic-multisite-scraper-post-generator-plugin-for-wordpress/20476010"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1283e839-8588-4a76-9c1e-61562526166d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T18:52:47.578425+00:00", "value": {"mitigation_remediation": ["Upgrade the Crawlomatic Multipage Scraper Post Generator plugin to a version where file type validation has been added.", "If an upgrade is not immediately possible, restrict the plugin\u2019s upload capabilities by configuring WordPress to allow only safe file types and preventing executable files from being stored in the uploads directory (e.g., by adjusting MIME type whitelisting).", "If the plugin is not required, uninstall it to eliminate the vulnerability.", "Implement explicit file type validation rules for uploads, following CWE\u2011434 best practices, to reject non\u2011image files and disallow executables."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Upload potentially leading to Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All versions of the plugin up to and including 2.6.8.1 are affected. The vendor is CodeRevolution, and the product is the Crawlomatic Multipage Scraper Post Generator for WordPress. No other vendors are listed as impacted.", "description_and_impact": "The Crawlomatic Multipage Scraper Post Generator plugin for WordPress suffers from a missing file type validation in the crawlomatic_generate_featured_image() function, a flaw classified as CWE-434, permitting any file to be uploaded via an unauthenticated request. This omission enables an attacker to place files such as PHP scripts on the server. The description states that this could permit remote code execution after upload, meaning the attacker could then navigate to the uploaded artifact to run arbitrary code.", "risk_and_exploitability": "The CVSS score of 9.8 signals a critical severity and the EPSS score of 2.565% indicates a moderate exploitation likelihood. The vulnerability is not present in CISA\u2019s KEV catalog. Because the flaw allows unauthenticated uploads without file type checks, an attacker can exploit the endpoint, upload a malicious script, and then trigger execution through the web server, potentially compromising the entire WordPress site."}}}}, "created": "2026-04-28T19:00:20.871806+00:00", "updated": "2026-04-28T19:00:20.871816+00:00", "vendors": []}