Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filter_content function. This is due to passing the attacker-supplied 'callback_raw' shortcode attribute directly into call_user_func() with no sanitization or allowlist validation, relying solely on an is_callable() check that permits dangerous PHP built-ins such as system, shell_exec, exec, passthru, and assert. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. An identical sink exists for the 'callback' attribute, providing a second independent vector through the same shortcode.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-29 | 1 | Patch1 |
| 2026-06-26 | 1 | Disclosure1 |
New advisory to triage: CVE-2026-9009. The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to… Inventory first. Panic never helps.
Post summary
A new advisory announces CVE‑2026‑9009, highlighting Remote Code Execution in the Crawlomatic plugin, with no exploit details or patch mention yet.
WordPress users running the Crawlomatic Multipage Scraper Post Generator plugin should update immediately. CVE-2026-9009 (CVSS 8.8) allows remote code execution in versions up to 2.7.2. https://nvd.nist.gov/vuln/detail/CVE-2026-9009 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning
Post summary
The text announces a remote code execution vulnerability (CVE-2026-9009) in the Crawlomatic plugin and urges users to apply the available patch immediately.