The vulnerability arises from unsanitized use of eval() on user‑supplied input in the Catalog Importer, Scraper & Crawler plugin. By sending a request that includes arbitrary PHP code, an attacker can cause the plugin to execute that code on the WordPress host, effectively gaining full control over the server. The flaw is a PHP code injection described by CWE‑94. Because the exploit does not require authentication and depends only on a guessable numeric token, it poses a high risk of code execution.

WordPress sites running the idiatech Catalog Importer, Scraper & Crawler plugin in version 5.1.4 or earlier are affected. These include all installations that have not applied a newer patch that removes the vulnerable eval() logic.

The CVSS score of 8.1 indicates a high severity. The EPSS score of <1% shows a low probability that this vulnerability is being actively exploited today. It is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request that targets the plugin’s communication endpoints, where an attacker can guess or brute‑force the numeric key and supply PHP code to be executed. Once the key is known, remote exploitation is straightforward.