CVE-2026-89274 Details

A vulnerability allowing arbitrary shortcode execution has been identified in the WP Recipe Maker plugin for WordPress, affecting all versions through 10.8.1. This vulnerability arises from the `WPRM_Metadata::sanitize_metadata()` function, which recursively applies `do_shortcode()` to each scalar field of the recipe's structured metadata. Notably, the `reviewBody` field, sourced directly from the `comment_content` of approved `wprm-comment-rating` comments, is processed without any prior sanitization or removal of shortcode tokens. Although `wp_strip_all_tags()` and `strip_shortcodes()` are called afterward, they only affect the output string post-execution, leaving room for server-side shortcode execution. As a result, unauthenticated attackers can execute arbitrary WordPress shortcodes on the server side during each recipe page render. The output of these shortcodes, which could include attachment captions, private post fields, or other data revealed by active shortcodes, gets embedded in the page's JSON-LD `reviewBody` metadata, accessible to all visitors viewing the recipe page. Exploitation requires the injected shortcode to be included in a comment that has passed the site's approval process, either automatically or through moderation.

Users are advised to update the WP Recipe Maker plugin to version 10.8.2 or a newer patched version.