The Crawlomatic Multipage Scraper Post Generator plugin for WordPress suffers from a missing file type validation in the crawlomatic_generate_featured_image() function, a flaw classified as CWE-434, permitting any file to be uploaded via an unauthenticated request. This omission enables an attacker to place files such as PHP scripts on the server. The description states that this could permit remote code execution after upload, meaning the attacker could then navigate to the uploaded artifact to run arbitrary code.

All versions of the plugin up to and including 2.6.8.1 are affected. The vendor is CodeRevolution, and the product is the Crawlomatic Multipage Scraper Post Generator for WordPress. No other vendors are listed as impacted.

The CVSS score of 9.8 signals a critical severity and the EPSS score of 2.565% indicates a moderate exploitation likelihood. The vulnerability is not present in CISA’s KEV catalog. Because the flaw allows unauthenticated uploads without file type checks, an attacker can exploit the endpoint, upload a malicious script, and then trigger execution through the web server, potentially compromising the entire WordPress site.