Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-4389 — Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload | Kitploit
Tools/GitHubGitHub/yucaerin/cve-2025-4389
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubyucaerin/cve-2025-4389

CVE-2025-4389

Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload

View Repository
11 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-4389 Exploit

Details

  • Published: May 16, 2025
  • Updated: May 17, 2025
  • Severity: Critical (CVSS Score: 9.8 )
  • CWE: CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type
  • Affected Versions: All versions from n/a through 2.6.8.1
  • Researcher: https://www.wordfence.com/threat-intel/vulnerabilities/researchers/friderika-baranyai

CVSS Vector

  • CVSS Version: 9.8
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlomatic_generate_featured_image() function in all versions up to, and including, 2.6.8.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Usage

root@kitploit:~
usage: python3 CVE-2025-4389.py

Script Details

Installation

  1. Clone the repository:
    root@kitploit:~
    git clone https://github.com/Yucaerin/CVE-2025-4389.git
cd CVE-2025-4389

Disclaimer

This script is intended for educational purposes only. Use it responsibly and only on systems for which you have explicit permission. Unauthorized use of this script is illegal and unethical.

Download Tool