The Crawlomatic Multipage Scraper Post Generator plugin for WordPress suffers from an unrestricted file upload vulnerability (CWE-434) in the crawlomatic_generate_featured_image() function. This vulnerability allows unauthenticated attackers to upload arbitrary files because the plugin does not validate file types properly. Exploitation could enable remote code execution on the web server hosting the plugin. The issue affects all versions up to and including 2.6.8.1. The vulnerability is publicly known and assigned CVE-2025-4389 with a CVSS 3.1 base score of 9.8, reflecting its critical severity. No patch or official remediation guidance is currently provided by the vendor.

Successful exploitation of this vulnerability can lead to arbitrary file upload by unauthenticated attackers, potentially resulting in remote code execution. This compromises the confidentiality, integrity, and availability of the affected web server and its data. Given the critical CVSS score of 9.8, the impact is severe and could allow full system compromise if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the Crawlomatic Multipage Scraper Post Generator plugin to prevent exploitation. Restricting file upload permissions and monitoring web server activity may help reduce risk, but these are not full mitigations. Stay alert for vendor updates providing an official patch or temporary fix.