CVE-2026-9009 is a remote code execution vulnerability in the Crawlomatic Multipage Scraper Post Generator WordPress plugin. The issue arises from the unsafe use of the 'callback_raw' and 'callback' shortcode attributes, which are passed directly to call_user_func() without sanitization or allowlist checks. The plugin only verifies if the function is callable, allowing dangerous PHP built-in functions such as system, shell_exec, exec, passthru, and assert to be invoked by authenticated users with author-level access or higher. This enables remote code execution on the server hosting the plugin. There is no vendor advisory or patch information available at this time.

An authenticated attacker with author-level or higher privileges can execute arbitrary PHP code on the server, potentially leading to full system compromise, data theft, or service disruption. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.