Executive Summary

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution (RCE) in all versions up to and including 2.7.2. This vulnerability arises because the plugin passes an attacker-supplied 'callback_raw' shortcode attribute directly into the PHP function call_user_func() without proper sanitization or allowlist validation.

The plugin only checks if the callback is callable using is_callable(), which allows dangerous PHP built-in functions such as system, shell_exec, exec, passthru, and assert to be executed. This enables authenticated attackers with author-level access or higher to execute arbitrary code on the server. There is also a second independent vector through the 'callback' shortcode attribute that is affected in the same way.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows authenticated users with author-level permissions or higher to execute arbitrary code on the server hosting the WordPress site.

• Attackers can run malicious commands or scripts, potentially leading to full server compromise.
• Sensitive data stored on the server could be accessed, modified, or deleted.
• The website could be defaced, used to distribute malware, or leveraged as a pivot point to attack other systems.
• Availability of the website and services could be disrupted by attackers.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should immediately update the Crawlomatic Multipage Scraper Post Generator plugin for WordPress to a version later than 2.7.2 where this issue is fixed.

Additionally, restrict author-level access and above to trusted users only, as the vulnerability requires authenticated users with author-level permissions.

Consider disabling or removing the vulnerable shortcode attributes 'callback_raw' and 'callback' if updating is not immediately possible.

Useful 0 Not Useful 0