CVE-2026-89274

Overview

The WP Recipe Maker plugin for WordPress up to version 10.8.1 insecurely executes shortcodes found within structured recipe metadata fields derived from user comments. This allows unauthenticated users to trigger server-side shortcode execution and potentially disclose sensitive data through page metadata. Exploitation relies on the malicious comment passing the site's comment approval process.

Description

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because `WPRM_Metadata::sanitize_metadata()` recursively calls `do_shortcode()` on every scalar field of the recipe's structured metadata array — including the `reviewBody` field, which is populated verbatim from the `comment_content` of approved `wprm-comment-rating` comments — without sanitizing or stripping shortcode tokens before execution; the subsequent `wp_strip_all_tags()` and `strip_shortcodes()` calls operate only on the output string after execution has already fully occurred, providing no protection against server-side shortcode invocation. This makes it possible for unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on every recipe page render, causing shortcode output — such as attachment captions, private post fields, or other data exposed by installed shortcodes — to be embedded in the page's JSON-LD `reviewBody` metadata and disclosed to all visitors who load the recipe page. Successful exploitation requires the attacker's rated comment to pass the site's comment approval threshold, either via auto-approval or moderator action, before the injected shortcode begins executing on page loads.

Impact

Unauthenticated attackers can potentially achieve data exposure by injecting shortcodes into comments that are subsequently rendered within JSON-LD review body metadata. Confidentiality is impacted as sensitive or restricted shortcode outputs may be disclosed to public visitors. Site administrators, content managers, and website visitors are indirectly impacted by the resulting data leakage.

Remediation

Update the WP Recipe Maker plugin to a patched version beyond 10.8.1 as soon as vendor updates become available. Implement strict comment moderation workflows to review and approve user comments before they are published. Review installed WordPress shortcodes to ensure they do not expose sensitive information when executed.

Risk context

This vulnerability is rated as critical with a CVSS v3 score of 9.1, indicating severe potential impact. The EPSS score of 0.00379 suggests a relatively low current exploitation probability, but the high severity warrants prompt attention and patching.

Affected products

• WP Recipe Maker