CVE-2025-8417: WordPress Catalog Importer RCE Vulnerability

CVE-2025-8417 Overview

A critical PHP code injection vulnerability has been discovered in the Catalog Importer, Scraper & Crawler plugin for WordPress, affecting all versions up to and including 5.1.4. The vulnerability stems from the plugin's reliance on a guessable numeric token for authentication combined with the unsafe use of eval() on user-supplied input. This dangerous combination allows unauthenticated attackers to execute arbitrary PHP code on vulnerable WordPress servers by guessing or brute-forcing the numeric key parameter.

Critical Impact

Unauthenticated remote code execution capability allows attackers to fully compromise WordPress installations, potentially leading to complete server takeover, data theft, and malware deployment.

Affected Products

• Catalog Importer, Scraper & Crawler plugin for WordPress versions ≤ 5.1.4
• WordPress sites with the "Intelligent Importer" plugin installed
• Any WordPress installation running vulnerable plugin versions

Discovery Timeline

• September 11, 2025 - CVE-2025-8417 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2025-8417

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The flaw exists within the communication.php file of the plugin, where incoming requests are authenticated using a predictable numeric token passed via the key parameter (e.g., ?key=900001705). The numeric key space is limited enough to be feasibly brute-forced by an attacker.

Once an attacker successfully guesses or brute-forces the authentication token, they can leverage the unsafe use of eval() to execute arbitrary PHP code. The network-accessible attack vector combined with no privilege requirements makes this vulnerability particularly dangerous for internet-facing WordPress installations. While the attack complexity is considered high due to the brute-forcing requirement, successful exploitation results in complete confidentiality, integrity, and availability impact on the target system.

Root Cause

The root cause of this vulnerability is twofold. First, the plugin implements a weak authentication mechanism that relies on a guessable numeric token rather than cryptographically secure authentication. Second, the plugin uses the dangerous eval() function to process user-controlled input without proper sanitization. This combination of weak access control and unsafe code execution creates a critical attack surface. The vulnerable code can be found in multiple locations within communication.php at lines 20, 244, 272, and 300, as well as in megaimporter.php at line 57.

Attack Vector

The attack vector is network-based, requiring no user interaction or prior authentication. An attacker would first identify a WordPress site running the vulnerable Catalog Importer plugin. They would then attempt to brute-force the numeric key parameter used for authentication. The numeric key space, while providing some barrier, is finite and can be enumerated programmatically. Once a valid key is discovered, the attacker crafts a malicious request containing PHP code that gets passed to the eval() function, resulting in arbitrary code execution on the server.

The exploitation flow involves sending HTTP requests with incrementing key values while including malicious PHP payload in the appropriate parameter. When a valid key is found and the request is processed, the injected PHP code executes with the privileges of the web server process.

Detection Methods for CVE-2025-8417

Indicators of Compromise

• Unusual HTTP requests to WordPress plugin endpoints containing the key parameter with rapidly incrementing numeric values
• Web server logs showing numerous requests to /wp-content/plugins/intelligent-importer/communication.php from single IP addresses
• Unexpected PHP processes or reverse shell connections originating from the web server
• New or modified files in WordPress directories with suspicious PHP code
• Unauthorized administrator accounts or modified user privileges in WordPress

Detection Strategies

• Monitor web application firewall (WAF) logs for brute-force patterns targeting the plugin's authentication endpoints
• Implement rate limiting on requests to plugin endpoints to slow brute-force attempts
• Deploy file integrity monitoring to detect unauthorized modifications to WordPress files
• Configure intrusion detection systems to alert on common PHP webshell signatures and reverse shell patterns

Monitoring Recommendations

• Enable detailed logging for WordPress plugin activity and HTTP requests
• Monitor for anomalous outbound connections from the web server that may indicate reverse shell activity
• Track creation of new PHP files in the WordPress installation directory
• Implement alerting for failed authentication attempts at abnormally high rates

How to Mitigate CVE-2025-8417

Immediate Actions Required

• Immediately disable or remove the Catalog Importer, Scraper & Crawler plugin if running version 5.1.4 or earlier
• Review web server logs for signs of exploitation attempts or successful compromise
• Scan the WordPress installation for unauthorized files, backdoors, or webshells
• Reset all WordPress user credentials and database passwords if compromise is suspected
• Consider restoring from a known-good backup if evidence of exploitation is found

Patch Information

Organizations should check with the plugin developer for a patched version that addresses this vulnerability. The vulnerability affects all versions up to and including 5.1.4. Monitor the Wordfence Vulnerability Report for updates on patch availability. Review the WordPress Plugin Code Reference for technical details about the vulnerable code locations.

Workarounds

• Block access to the plugin's communication.php endpoint at the web server or firewall level if the plugin functionality is not required
• Implement IP-based access restrictions to limit who can reach the plugin's endpoints
• Deploy a Web Application Firewall (WAF) with rules to detect and block PHP code injection attempts
• Consider using WordPress security plugins that provide real-time threat detection and blocking capabilities

# Apache configuration to block access to vulnerable endpoint
<Directory "/var/www/html/wp-content/plugins/intelligent-importer">
    <Files "communication.php">
        Order deny,allow
        Deny from all
        # Allow only specific trusted IPs if needed
        # Allow from 192.168.1.0/24
    </Files>
</Directory>