CVE-2026-9009: Crawlomatic Plugin RCE via Unsafe Callback Validation

Technical summary

The filter_content function in Crawlomatic's shortcode handler fails to sanitize the 'callback_raw' and 'callback' attributes before passing them to call_user_func(). While the code performs an is_callable() check to verify the input references a valid PHP function, this check does not prevent invocation of dangerous built-in functions. PHP built-ins such as system, shell_exec, exec, passthru, and assert all return true for is_callable(), and when invoked through call_user_func() with attacker-controlled parameters, they enable arbitrary command execution on the server. The vulnerability affects both the 'callback_raw' and 'callback' shortcode attributes, creating two independent exploitation paths.

Business impact

Compromised WordPress sites running this plugin become fully controllable by attackers with author access, enabling data exfiltration, malware installation, lateral movement within hosting environments, and denial of service. For multi-tenant environments and shared hosting, the impact extends to neighboring sites and customer data. Reputational harm, regulatory liability (GDPR, PCI-DSS), and operational disruption are significant downstream consequences.

Affected systems

WordPress sites running the Crawlomatic Multipage Scraper Post Generator plugin in versions 2.7.2 and earlier are affected. The vulnerability requires authenticated access at the author level or above, limiting immediate risk to sites where the attacker already holds credentials or where such credentials have been compromised. Sites relying on this plugin for content generation workflows are at highest risk.

Exploitability

Exploitation requires valid WordPress authentication with author-level or higher privileges. This is a moderate barrier that eliminates opportunistic mass exploitation, but represents a significant insider threat and a critical risk vector for compromised user accounts. Once an attacker gains author credentials through credential theft, phishing, or account compromise, exploitation is straightforward and requires no advanced technical skill—a simple shortcode invocation suffices. The vulnerability is not known to be actively exploited in the wild, but the relative simplicity of weaponization makes future exploitation likely.

Remediation

Update the Crawlomatic plugin to a version that implements proper input validation and function whitelisting. Verify the latest patched version against the vendor's official advisory. As an interim measure, restrict author-level access to trusted users, implement role-based access controls, and disable the plugin if it is not actively in use. Consider temporarily disabling shortcode processing if alternative content strategies are available.

Patch guidance

Consult the Crawlomatic plugin vendor's official security advisory for the specific patched version that addresses this vulnerability. Verify the patch version number and release date before deployment. Apply updates through WordPress's plugin management dashboard or via manual deployment from the vendor. Test in a staging environment before production rollout to ensure compatibility with existing content and custom workflows.

Detection guidance

Monitor WordPress logs and server logs for shortcodes containing the 'callback_raw' or 'callback' attributes paired with dangerous PHP function names (system, shell_exec, exec, passthru, assert). Web Application Firewalls (WAF) can be configured to block POST requests containing these patterns in shortcode syntax. Review author-level user activity logs for suspicious shortcode creation or modification. Implement file integrity monitoring to detect unauthorized changes to plugin files or new webshell creation in uploads or plugin directories.

Why prioritize this

This vulnerability merits immediate attention despite its authentication requirement. CVSS 8.8 reflects the high severity of unauthenticated code execution impact, and the combination of two independent attack vectors increases risk surface. Organizations should prioritize patching within their maintenance windows, with highest urgency given to multi-tenant and publicly accessible sites. The straightforward exploitation path and widespread use of WordPress make this a preferred target for attackers with inside access.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability with high integrity, confidentiality, and availability impact. The score accounts for the requirement of low-privilege authentication (PR:L) but does not require user interaction. The presence of two independent exploitation vectors and the nature of code execution as a consequence elevate this to the highest practical risk category. Organizations should treat this as a critical patch for exposed WordPress instances.

Frequently asked questions