CVE-2025-8417: PHP Code Injection in Catalog Importer

The impact of this vulnerability is severe. Successful exploitation allows an attacker to execute arbitrary PHP code on the WordPress server. This can lead to a wide range of malicious activities, including data theft, website defacement, malware installation, and complete server takeover. The lack of authentication requirements significantly lowers the barrier to entry for attackers, making this a high-priority risk. Attackers could potentially gain access to sensitive data stored on the server, including user credentials, database information, and configuration files. Lateral movement within the network is also possible if the server has access to other systems.

1. Reserved2025-07-31
2. Published2025-09-11
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade the Catalog Importer, Scraper & Crawler plugin to a patched version as soon as it becomes available. Until a patch is released, consider temporarily disabling the plugin if it is not essential. As a temporary workaround, implement strict input validation and sanitization on any user-supplied data used within the plugin. Web application firewalls (WAFs) can be configured to block requests containing suspicious numeric tokens in the query string. Monitor WordPress access logs for unusual activity, particularly requests containing numeric keys in the URL. After upgrading, verify the fix by attempting to access the plugin's import functionality with a forged numeric key; the request should be denied.