CVE-2025-11755
BaseFortify
Publication date: 2025-11-01
Last updated on: 2025-11-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | delicious_recipes | 1.9.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the WP Delicious – Recipe Plugin for Food Bloggers for WordPress, versions up to and including 1.9.0. It allows an attacker with at least Contributor-level permissions to upload arbitrary files by importing recipes via CSV. Specifically, the attacker can provide a remote URL during the recipe import process to upload a malicious PHP file, which can then lead to Remote Code Execution (RCE) on the affected site.
How can this vulnerability impact me? :
This vulnerability can have a severe impact as it allows an attacker to execute arbitrary code on your WordPress site remotely. This can lead to full compromise of the website, including data theft, defacement, installation of malware, or using the site as a launchpad for further attacks. Since the attacker only needs Contributor-level permissions, which are commonly granted to trusted users, the risk is significant.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the WP Delicious – Recipe Plugin for Food Bloggers to a version later than 1.9.0 where the arbitrary file upload flaw is fixed. Additionally, restrict Contributor-level users from importing recipes via CSV until the update is applied, and monitor for any suspicious file uploads or remote code execution attempts related to recipe imports.