Arbitrary Shortcode Execution in WP Recipe Maker Plugin for WordPress

CVE-2026-89274

What is CVE-2026-89274?

The WP Recipe Maker plugin for WordPress is vulnerable due to a flaw that allows unauthorized execution of registered shortcodes on recipe pages. This arises from the method 'WPRM_Metadata::sanitize_metadata()' which processes every scalar field of the recipe's metadata, including 'reviewBody', without adequate sanitization. Consequently, an unauthenticated attacker can inject malicious shortcodes via approved comments, thereby embedding potentially sensitive data like attachment captions or private post details in the page's JSON-LD metadata. The exploitation of this vulnerability requires the injected comment to pass site moderation, leading to unintended disclosure of information to all visitors accessing the recipe page.

References