CVE-2025-49294: Crawlomatic Information Disclosure Flaw

CVE-2025-49294 Overview

CVE-2025-49294 is a sensitive information disclosure vulnerability in the CodeRevolution Crawlomatic Multisite Scraper Post Generator WordPress plugin. The flaw affects all versions up to and including 2.6.8.2 and is categorized under [CWE-201]: Insertion of Sensitive Information Into Sent Data. Unauthenticated attackers can retrieve embedded sensitive data through exposed log files over the network. The issue requires no privileges and no user interaction, making it accessible to any remote actor who can reach the affected WordPress instance.

Critical Impact
Remote unauthenticated attackers can retrieve sensitive information embedded in plugin log data, potentially exposing API keys, scraping targets, or configuration details.

Affected Products

CodeRevolution Crawlomatic Multisite Scraper Post Generator plugin for WordPress
All versions from initial release through 2.6.8.2
WordPress sites using the crawlomatic-multipage-scraper-post-generator plugin

Discovery Timeline

2025-06-06 - CVE-2025-49294 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49294

Vulnerability Analysis

The vulnerability stems from improper handling of log data produced by the Crawlomatic Multisite Scraper Post Generator plugin. Log files generated during scraping and post-generation activities contain sensitive information but are stored in a location accessible without authentication. Any remote user who knows or can guess the log path can retrieve the exposed content directly over HTTP.

This maps to [CWE-201]: Insertion of Sensitive Information Into Sent Data. The plugin writes operational data — which may include scraping targets, request parameters, response fragments, tokens, or configuration values — into files served by the WordPress web root. The confidentiality impact is scored as low because integrity and availability are not affected, but the exposed material may contain credentials or API keys that enable follow-on attacks.

The EPSS probability for this CVE is 0.306%, indicating a low current likelihood of exploitation attempts, though public disclosure of the log path increases risk.

Root Cause

The plugin writes verbose operational logs containing sensitive data to a predictable, web-accessible path without applying access controls, request authentication, or .htaccess restrictions. Sensitive fields are not redacted before being written to disk.

Attack Vector

An unauthenticated remote attacker sends an HTTP GET request to the log file location on a vulnerable WordPress site. The web server returns the raw log contents. No credentials, session, or user interaction are required. The vulnerability is exploitable across the network against any exposed WordPress deployment running the affected plugin version.

No public proof-of-concept code is available. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-49294

Indicators of Compromise

HTTP GET requests to log file paths under /wp-content/plugins/crawlomatic-multipage-scraper-post-generator/ from unfamiliar IP addresses.
Successful 200 OK responses to requests for files with .log, .txt, or similar extensions inside the plugin directory.
Repeated access attempts targeting plugin subdirectories from scanning tools or automated crawlers.

Detection Strategies

Review web server access logs for direct requests to plugin-owned files that return non-empty responses without authentication.
Alert on responses containing keywords such as api_key, token, password, or scraper target URLs served from the plugin path.
Correlate WordPress plugin inventories with the vulnerable version range <= 2.6.8.2 to identify at-risk hosts.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform to search for anomalous plugin file access patterns.
Monitor outbound use of any API keys or credentials known to be referenced by the plugin for signs of downstream abuse.
Track file integrity and permissions on the plugin's log directory to detect unexpected exposure.

How to Mitigate CVE-2025-49294

Immediate Actions Required

Identify all WordPress sites running Crawlomatic Multisite Scraper Post Generator version 2.6.8.2 or earlier.
Update the plugin to a version released after 2.6.8.2 once the vendor publishes a fix.
Rotate any API keys, credentials, or tokens that the plugin may have written to log files.

Patch Information

As of the latest NVD update, the advisory lists affected versions from n/a through <= 2.6.8.2. Administrators should consult the Patchstack Vulnerability Report and the CodeRevolution vendor page for the latest fixed release and apply it promptly.

Workarounds

Restrict direct web access to the plugin directory using web server rules or a .htaccess deny directive for log file extensions.
Deploy a Web Application Firewall (WAF) rule blocking unauthenticated requests to /wp-content/plugins/crawlomatic-multipage-scraper-post-generator/ file paths that expose logs.
Delete existing log files from the web root and reconfigure the plugin, if possible, to write logs outside the document root.
Disable the plugin until a patched version is available if the site does not require active scraping operations.

bash

# Example Apache .htaccess rule to block direct access to plugin log files
<FilesMatch "\.(log|txt)$">
    Require all denied
</FilesMatch>