CVE-2025-4389

CRITICAL

Crawlomatic Multipage Scraper Post Generator <2.6.8.1 - File Upload

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-4389. PoCs published by Yucaerin.

AI-analyzed exploit summary This PoC exploits CVE-2025-4389, an arbitrary file upload vulnerability in the Crawlomatic Multipage Scraper Post Generator WordPress plugin. It uploads a malicious JSON payload to trigger remote code execution via a cron job, then checks for the presence of a backdoor keyword.

Description

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlomatic_generate_featured_image() function in all versions up to, and including, 2.6.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Exploits (1)

nomisec WORKING POC

by Yucaerin · poc

https://github.com/Yucaerin/CVE-2025-4389

View Code ZIP pw:eip

This PoC exploits CVE-2025-4389, an arbitrary file upload vulnerability in the Crawlomatic Multipage Scraper Post Generator WordPress plugin. It uploads a malicious JSON payload to trigger remote code execution via a cron job, then checks for the presence of a backdoor keyword.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Crawlomatic Multipage Scraper Post Generator (WordPress plugin) <= 2.6.8.1

No auth needed

Prerequisites: Target list file (list.txt) · Python environment with required libraries (requests, aiohttp, bs4)

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1505.003 - Web Shell

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Various Sources

https://codecanyon.net/item/crawlomatic-multisite-scraper-post-generator-plugin-for-wordpress/20476010

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/1283e839-8588-4a76-9c1e-61562526166d?source=cve

Scores

CVSS v3 9.8

EPSS 0.0084

EPSS Percentile 52.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-434

Status published

Products (1)

CodeRevolution/Crawlomatic Multipage Scraper Post Generator < 2.6.8.1

Published May 17, 2025

Tracked Since Feb 18, 2026