Arbitrary Shortcode Execution in WP Recipe Maker Plugin for WordPress
CVE-2026-89274

9.1CRITICAL

Key Information:

Vendor

WordPress
Status
WP Recipe Maker
Vendor
CVE Published:
19 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-89274?

The WP Recipe Maker plugin for WordPress is vulnerable due to a flaw that allows unauthorized execution of registered shortcodes on recipe pages. This arises from the method 'WPRM_Metadata::sanitize_metadata()' which processes every scalar field of the recipe's metadata, including 'reviewBody', without adequate sanitization. Consequently, an unauthenticated attacker can inject malicious shortcodes via approved comments, thereby embedding potentially sensitive data like attachment captions or private post details in the page's JSON-LD metadata. The exploitation of this vulnerability requires the injected comment to pass site moderation, leading to unintended disclosure of information to all visitors accessing the recipe page.

Affected Version(s)

WP Recipe Maker 0 <= 10.8.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

By-Poloss..-.CVE-2026-89274
Created by Polosss

CVE-2026-89274-wp-recipe-maker-poc
Created by Hassham1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-recipe-make...
https://plugins.trac.wordpress.org/browser/wp-recipe-make...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Md. Moniruzzaman Prodhan (NomanProdhan)
.