CVE-2025-49294
BaseFortify
Publication date: 2025-06-06
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Crawlomatic Multisite Scraper Post Generator plugin (up to version 2.6.8.2) allows unauthenticated attackers to access sensitive information that should normally be restricted. It is classified as a Sensitive Data Exposure issue, meaning sensitive data is inserted into sent data and can be retrieved by attackers without any privileges. [1]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to sensitive information, potentially enabling attackers to exploit the system further. Since it requires no privileges to exploit, any unauthenticated user can retrieve embedded sensitive data, which may compromise the confidentiality of your data and the security of your website. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The provided resources do not include specific commands or detailed detection methods for identifying this vulnerability on your network or system. It is noted that plugin-based malware scanners may be unreliable for detecting this issue. For precise detection, professional incident response services are recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, update the Crawlomatic Multisite Scraper Post Generator plugin to version 2.6.9 or later, where the issue is fixed. Additionally, Patchstack offers virtual patching (vPatching) as an immediate protective measure that auto-mitigates vulnerabilities even before official patches are released. If your website is compromised, consider engaging professional incident response services. [1]