The Crawlomatic Multipage Scraper Post Generator plugin contains a shortcode that accepts a 'callback_raw' attribute. The plugin passes this value directly to call_user_func without any sanitization or allowlist validation. This allows an authenticated user with author access or higher to specify PHP built‑in functions such as system, exec, shell_exec, passthru, or assert, which are then executed on the server. The result is a critical Remote Code Execution flaw classified as CWE‑434, providing full code execution capability on the hosting machine.

All installations of the Crawlomatic Multipage Scraper Post Generator plugin for WordPress, version 2.7.2 and earlier, distributed by CodeRevolution. The vulnerability resides in the filter_content method in class.crawlomatic.shortcode.php. No other product versions are listed as affected.

The CVSS score of 8.8 signals a high severity vulnerability. EPSS data is not available and the flaw is not listed in CISA KEV. Exploitation requires the attacker to be an authenticated user with at least author privileges, after which they can embed a malicious shortcode that triggers code execution. An identical payload can be delivered via the 'callback' attribute, creating a second independent attack path. The attack vector is local through the WordPress administration interface, but once the payload is inserted it runs with the permissions of the web server, posing a severe threat.