CVE-2026-9009

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filter_content function. This is due to passing the attacker-supplied 'callback_raw' shortcode attribute directly into call_user_func() with no sanitization or allowlist validation, relying solely on an is_callable() check that permits dangerous PHP built-ins such as system, shell_exec, exec, passthru, and assert. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. An identical sink exists for the 'callback' attribute, providing a second independent vector through the same shortcode.

• CWE-434

• https://plugins.trac.wordpress.org/browser/crawlomatic-multipage-scraper-post-generator/trunk/class.crawlomatic.shortcode.php#L273
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7ff39b8f-ef87-4b1c-888e-00c9599c7b07?source=cve

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8997vifm is vulnerable to a heap buffer overflow during the hist…4.8
• CVE-2026-9002IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could al…6.5
• CVE-2026-9003E-LAN Hybrid Recording System developed by TONNET has a SQL …8.7
• CVE-2026-9006IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …9.1
• CVE-2026-9007Improper neutralization of input during web page generation …5.5
• CVE-2026-9008The Page-list plugin for WordPress is vulnerable to Missing …4.3
• CVE-2026-9010The Boost plugin for WordPress is vulnerable to time-based S…7.5
• CVE-2026-9011The Ditty – Responsive News Tickers, Sliders, and Lists plug…7.5
• CVE-2026-9013The Bogo plugin for WordPress is vulnerable to Sensitive Inf…4.3
• CVE-2026-9014The WP Promoter plugin for WordPress is vulnerable to unauth…5.3
• CVE-2026-9015The Equalize Digital Accessibility Checker – WCAG, ADA, EAA …4.3
• CVE-2026-9016The Debug Log Manager – Conveniently Monitor and Inspect Err…5.3