PHP Code Injection in Catalog Importer, Scraper & Crawler Plugin for WordPress

CVE-2025-8417

What is CVE-2025-8417?

The Catalog Importer, Scraper & Crawler plugin for WordPress is susceptible to a PHP code injection. This vulnerability arises from the reliance on a predictable numeric token without adequate authentication and the unsafe execution of user-supplied input via eval(). As a result, unauthenticated attackers can potentially execute arbitrary PHP code on the server by crafting a request that includes a correctly guessed or brute-forced numeric key. This poses a significant risk to the integrity and security of impacted WordPress sites.

References