Arbitrary File Upload in Crawlomatic Multipage Scraper Post Generator
CVE-2025-4389 affects the Crawlomatic Multipage Scraper Post Generator plugin for WordPress in all versions up to and including 2.6.8.1. The vulnerability is caused by missing file type validation in the crawlomatic_generate_featured_image() function. Because uploaded files are not properly restricted to safe types, an unauthenticated attacker can upload arbitrary files to the affected server. If the server stores the uploaded file in a web-accessible or executable location, this can be leveraged to achieve remote code execution.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a Python proof-of-concept exploit for CVE-2025-4389, a critical vulnerability in the Crawlomatic Multipage Scraper Post Generator WordPress plugin (<=2.6.8.1). The exploit targets the plugin's admin-ajax.php endpoint, which is vulnerable to arbitrary file upload due to missing file type validation. The script reads a list of target hosts from 'list.txt', attempts to upload a crafted JSON settings file to each target, and then periodically checks if the payload was successfully executed by looking for a specific keyword in the target's homepage. Results are logged to 'waiting.txt' and 'result_interval.txt'. The repository consists of the main exploit script (CVE-2025-4389.py) and a README file with vulnerability details and usage instructions. The exploit is network-based and requires the target to be accessible over HTTP. No fake or destructive code is present; the script is a functional proof-of-concept for the described vulnerability.
Recent activity
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.