Crawlomatic Multipage Scraper Post Generator WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Crawlomatic Multipage Scraper Post Generator plugin for WordPress, affecting all versions through 2.6.8.1. The issue arises from inadequate file type validation in the crawlomatic_generate_featured_image() function, enabling unauthenticated attackers to upload arbitrary files to the affected site's server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution on the affected server.