Arbitrary File Upload Vulnerability in WP Delicious - Recipe Plugin for WordPress

CVE-2025-11755

What is CVE-2025-11755?

The WP Delicious – Recipe Plugin for WordPress, formerly known as Delicious Recipes, contains a significant vulnerability that allows attackers to exploit arbitrary file uploads during the recipe import process via CSV files. This issue is present in all versions leading up to and including 1.9.0. An attacker with Contributor-level permissions can manipulate the recipe import function to provide a malicious PHP file URL, which can then be executed, resulting in Remote Code Execution (RCE). This security flaw poses a serious risk to WordPress sites using this plugin, facilitating unauthorized access and control.

References