Crawlomatic Multipage Scraper Post Generator Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Crawlomatic Multipage Scraper Post Generator plugin for WordPress, affecting all versions through 2.7.2. The issue arises in the filter_content function, where the 'callback_raw' shortcode attribute is passed directly to call_user_func() without proper sanitization or validation. This oversight allows authenticated attackers with author-level access or higher to execute arbitrary code on the server, as the is_callable() check permits the use of dangerous PHP functions like system, shell_exec, exec, passthru, and assert. Additionally, the 'callback' attribute presents a separate but similar vector for exploitation.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the affected WordPress site is hosted.

Remediation

Users are advised to update the Crawlomatic Multipage Scraper Post Generator plugin to version 2.7.3 or a newer patched version.