WordPress Plugin Allows Unauthenticated Remote Code Execution

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filter_content function. This is due to passing the attacker-supplied 'callback_raw' shortcode attribute directly into call_user_func() with no sanitization or allowlist validation, relying solely on an is_callable() check that permits dangerous PHP built-ins such as system, shell_exec, exec, passthru, and assert. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. An identical sink exists for the 'callback' attribute, providing a second independent vector through the same shortcode.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress contains a critical remote code execution vulnerability in its filter_content function that affects all versions up to 2.7.2. The vulnerability stems from unsafe use of call_user_func() with user-supplied input from the 'callback_raw' shortcode attribute. While the code performs an is_callable() check, this validation is insufficient because it permits execution of dangerous PHP built-ins like system, shell_exec, exec, passthru, and assert—functions specifically designed to execute arbitrary system commands. Any attacker can exploit this by crafting a malicious shortcode to execute arbitrary code on affected WordPress installations, potentially leading to complete server compromise. This affects thousands of WordPress sites using this plugin, making it a high-impact vulnerability with a CVSS score of 8.8.

Casky's 419 matching security skills leverage Claude's extended reasoning to detect the attack patterns associated with this vulnerability across three critical MITRE ATT&CK tactics: Initial Access (TA0001), Persistence (TA0043), and Execution (TA0002). Practitioners using Casky would identify indicators including: suspicious shortcode patterns containing callback parameters pointing to PHP built-ins, anomalous call_user_func() executions with user-controlled arguments, and POST requests to WordPress pages containing the vulnerable plugin with crafted callback_raw attributes. The platform's skill set would flag inadequate input validation on callback parameters, execution of system command functions through indirect invocation, and the absence of allowlist-based function validation. Findings would highlight the progression from initial access through a malicious shortcode injection to code execution and potential persistence mechanisms, enabling security teams to detect both active exploitation attempts and post-compromise forensic evidence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-9009.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-9009

Casky has 419 skills that investigate the attack patterns behind CVE-2026-9009. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn