CVE-2025-8417CWE-94

Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection

High · published September 11, 2025

CVSS v3.1
8.1
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token (e.g. ?key= 900001705) without proper authentication, combined with the unsafe use of eval() on user-supplied input. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server via a forged request granted they can guess or brute-force the numeric key.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00696 · 52.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-09-11T07:24Z
EPSS history
Timeline
  • 11 SEP 07:24Z
    Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection
    cvelistv5