The Crawlomatic Multipage Scraper Post Generator plugin contains an unrestricted file upload vulnerability that may allow an authenticated attacker to execute arbitrary code.

The plugin suffers from an unrestricted file upload vulnerability (CWE-434). Per the CVSS vector, the attacker must have low privileges (PR:L), meaning this is an authenticated exploit targeting the plugin's functionality.

By uploading malicious scripts, an attacker can gain remote code execution capabilities on the WordPress server. This leads to a total loss of site integrity and potential compromise of the underlying server environment, including the database and sensitive configuration files. With a CVSS score of 8.8, this vulnerability represents a high-severity threat to any organization relying on this plugin.

Immediate Action: Update the Crawlomatic Multipage Scraper Post Generator plugin to version 2.7.3 or later.

Proactive Monitoring: Audit the WordPress media and plugin directories for any unauthorized PHP files or scripts that deviate from the expected installation footprint.

Compensating Controls: Implement a WAF to inspect and block file upload requests that contain non-permitted file extensions or executable code patterns.

Public Exploit Available: Unknown

The severity of this remote code execution vulnerability necessitates immediate action. Administrators must update the affected plugin to version 2.7.3 immediately and conduct a review of user permissions to ensure that only trusted users have the ability to interact with administrative or plugin-specific settings.