Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection

The impact of this vulnerability is severe. Successful exploitation allows an attacker to execute arbitrary PHP code on the WordPress server. This can lead to a wide range of malicious activities, including data theft, website defacement, malware installation, and complete server takeover. The lack of authentication requirements significantly lowers the barrier to entry for attackers, making this a high-priority risk. Attackers could potentially gain access to sensitive data stored on the server, including user credentials, database information, and configuration files. Lateral movement within the network is also possible if the server has access to other systems.

WordPress websites utilizing the Catalog Importer, Scraper & Crawler plugin, particularly those running versions 0.0.0 through 5.1.4, are at significant risk. Shared hosting environments are especially vulnerable as they often have limited access controls and increased exposure to malicious actors.

• wordpress / composer / npm:

grep -r 'eval($_GET["key"]' /var/www/html/wp-content/plugins/catalog-importer-scraper-crawler/

• generic web:

curl -I 'https://your-wordpress-site.com/?key=900001705' # Check for successful response

1. 2025-09-11Disclosure

   disclosure

1. Réservé2025-07-31
2. Publiée2025-09-11
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The primary mitigation is to immediately upgrade the Catalog Importer, Scraper & Crawler plugin to a patched version as soon as it becomes available. Until a patch is released, consider temporarily disabling the plugin if it is not essential. As a temporary workaround, implement strict input validation and sanitization on any user-supplied data used within the plugin. Web application firewalls (WAFs) can be configured to block requests containing suspicious numeric tokens in the query string. Monitor WordPress access logs for unusual activity, particularly requests containing numeric keys in the URL. After upgrading, verify the fix by attempting to access the plugin's import functionality with a forged numeric key; the request should be denied.