CVE-2025-8417
Published: 11 September 2025
Summary
CVE-2025-8417 is a high-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-8417 is a PHP code injection vulnerability (CWE-94) affecting the Catalog Importer, Scraper & Crawler plugin for WordPress in all versions up to and including 5.1.4. The flaw stems from the plugin's reliance on a guessable numeric token, such as ?key=900001705, for access without proper authentication, coupled with the unsafe use of the eval() function on user-supplied input. This combination allows arbitrary PHP code execution on the affected server. The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impacts with network accessibility but high attack complexity.
Unauthenticated attackers can exploit this vulnerability by guessing or brute-forcing the numeric key and crafting a forged HTTP request to the vulnerable endpoint. Successful exploitation grants remote code execution (RCE) on the WordPress server, potentially enabling full server compromise, data theft, backdoor installation, or further lateral movement within the environment.
References provided in the CVE point to specific vulnerable code locations in the plugin's source, including lines 20, 244, 272, and 300 in communication.php, and line 57 in megaimporter.php, highlighting the token handling and eval() usage. No patch or mitigation details are specified in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-27664
Vulnerability details
The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token (e.g. ?key= 900001705) without proper authentication, combined…
more
with the unsafe use of eval() on user-supplied input. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server via a forged request granted they can guess or brute-force the numeric key.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct RCE via unauthenticated code injection in public-facing WordPress plugin (eval on user input after weak token auth) maps to exploitation of public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates PHP code injection by requiring validation and sanitization of user-supplied input before processing with unsafe functions like eval().
Enforces approved authorizations to block unauthenticated access to the vulnerable endpoint relying on guessable numeric tokens.
Requires timely identification, reporting, and correction of flaws like the unsafe eval() usage and weak token authentication in the plugin.