RCE in Idiatech Catalog Importer, Scraper & Crawler
CVE-2025-8417
The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token (e.g. ?key= 900001705) without proper authen…
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.007 (46.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Idiatech Catalog Importer, Scraper & Crawler — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-8417?
- CVE-2025-8417 is a high-severity vulnerability in Idiatech Catalog Importer, Scraper & Crawler, classified under Code Injection. CVSS score: 8.1/10. Published 2025-09-11.
- How severe is CVE-2025-8417?
- High severity. CVSS v3 base score is 8.1 out of 10.