Remote Code Execution Vulnerability in Crawlomatic Multipage Scraper Post Generator for WordPress
CVE-2026-9009
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 28 May 2026
What is CVE-2026-9009?
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress presents a significant security risk due to its vulnerability to Remote Code Execution. This issue arises from improper handling of attacker-supplied input in the 'callback_raw' shortcode attribute, which is directly passed to the call_user_func() function without adequate sanitization. By exploiting this flaw, authenticated users with author-level access can execute arbitrary PHP code on the server. An additional attack vector also exists via the 'callback' attribute, amplifying the risk. This vulnerability underscores the importance of robust input validation and sanitization in plugin development.
Affected Version(s)
Crawlomatic Multipage Scraper Post Generator 0 <= 2.7.2