A WordPress plugin that mechanically posts content material scraped from different web sites has been found to include a essential vulnerability that permits anybody to add malicious information to affected web sites. The severity of the vulnerability is rated at 9.8 on a scale of 1-10.
Crawlomatic Multisite Scraper Publish Generator Plugin for WordPress
The Crawlomatic WordPress plugin is bought by way of the Envato CodeCanyon retailer for $59 per license. It allows customers to crawl boards, climate statistics, articles from RSS feeds, and immediately scrape the content material from different web sites after which mechanically publish the content material on the person’s web site.
The plugin’s Envato CodeCanyon net web page incorporates a banner that notes that the creator of the plugin has been acknowledged for having met “WordPress high quality requirements” and shows a badge indicating that it’s “Envato WP Necessities Compliant,” a sign that it meets Envato’s “safety, high quality, efficiency and coding requirements in WordPress plugins and themes.”
The plugin’s listing web page explains that it it will possibly crawl and scrape nearly any web site, together with JavaScript-based websites, promising that it will possibly flip a person’s web site right into a “cash making machine.”
Unauthenticated Arbitrary File Add
The Crawlomatic WordPress plugin is lacking a filetype validation verify in all model previous to and together with model 2.6.8.1.
In response to a warning posted on Wordfence:
“The Crawlomatic Multipage Scraper Publish Generator plugin for WordPress is weak to arbitrary file uploads attributable to lacking file sort validation within the crawlomatic_generate_featured_image() perform in all variations as much as, and together with, 2.6.8.1. This makes it attainable for unauthenticated attackers to add arbitrary information on the affected website’s server which can make distant code execution attainable.”
Customers of the plugin are really useful by Wordfence to replace to a minimum of model 2.6.8.2.
Learn extra at Wordfence:
Crawlomatic Multipage Scraper Publish Generator
Featured Picture by Shutterstock/nakaridore
