CVE-2026-89274

Received Received - Intake

Arbitrary Shortcode Execution in WP Recipe Maker

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because `WPRM_Metadata::sanitize_metadata()` recursively calls `do_shortcode()` on every scalar field of the recipe's structured metadata array — including the `reviewBody` field, which is populated verbatim from the `comment_content` of approved `wprm-comment-rating` comments — without sanitizing or stripping shortcode tokens before execution; the subsequent `wp_strip_all_tags()` and `strip_shortcodes()` calls operate only on the output string after execution has already fully occurred, providing no protection against server-side shortcode invocation. This makes it possible for unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on every recipe page render, causing shortcode output — such as attachment captions, private post fields, or other data exposed by installed shortcodes — to be embedded in the page's JSON-LD `reviewBody` metadata and disclosed to all visitors who load the recipe page. Successful exploitation requires the attacker's rated comment to pass the site's comment approval threshold, either via auto-approval or moderator action, before the injected shortcode begins executing on page loads.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-89274

Affected Vendors & Products

Vendor	Product	Version / Range
wp_recipe_maker	wp_recipe_maker	to 10.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in the WP Recipe Maker WordPress plugin allows unauthenticated attackers to execute arbitrary shortcodes on the server side by injecting them into approved comments. The plugin processes these comments without properly sanitizing shortcode tokens before execution, leading to potential data exposure in recipe pages.

Detection Guidance

Check for unauthorized shortcode execution in WordPress recipe pages by inspecting server logs for unexpected shortcode output in JSON-LD metadata. Review approved comments containing 'wprm-comment-rating' for suspicious shortcode content in the reviewBody field.

Impact Analysis

An attacker could exploit this to embed malicious shortcodes that expose sensitive data like private post content or attachment details to all visitors of affected recipe pages. This could lead to unauthorized information disclosure or further compromise of the WordPress site.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive user data or private content without authorization. GDPR and HIPAA mandate strict data protection, and unauthorized disclosure may result in legal penalties or reputational damage.

Mitigation Strategies

Update the WP Recipe Maker plugin to the latest version beyond 10.8.1. Temporarily disable shortcode execution in comments or restrict comment approval to trusted users until patched. Monitor for unusual server-side shortcode activity in logs.

Hi! I’m here to help you understand CVE-2026-89274. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70