The Catalog Importer, Scraper & Crawler plugin for WordPress suffers from a PHP code injection vulnerability (CWE-94) due to reliance on a guessable numeric token for authentication and unsafe use of eval() on user-supplied input. This enables unauthenticated remote attackers to execute arbitrary PHP code by sending a crafted request with a guessed numeric key parameter. The vulnerability affects all versions up to and including 5.1.4. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the affected server, potentially leading to full system compromise, data theft, data modification, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable plugin functionality by limiting exposure of the numeric key parameter and consider disabling or removing the plugin if not essential. Monitor for updates from the vendor and apply any official patches promptly once released.