Cyber & AI intelligence
Wasteland.
Briefs indexed2769
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-89274 2026-09-19

CVE-2026-89274: Unauthenticated Shortcode Execution in WP Recipe Maker

"A critical (CVSS 9.1) flaw in the WP Recipe Maker WordPress plugin lets unauthenticated attackers plant shortcodes in a recipe comment that the server then executes on every page render, leaking internal data into…"

A critical (CVSS 9.1) flaw in the WP Recipe Maker WordPress plugin lets unauthenticated attackers plant shortcodes in a recipe comment that the server then executes on every page render, leaking internal data into public JSON-LD metadata.

What Is It

WP Recipe Maker builds structured metadata for recipe pages through WPRM_Metadata::sanitize_metadata(). That function recursively calls do_shortcode() on every scalar field in the metadata array; including reviewBody, which is populated verbatim from the comment_content of approved wprm-comment-rating comments. No sanitization or stripping of shortcode tokens happens before execution. The wp_strip_all_tags() and strip_shortcodes() calls that follow operate only on the output string, after the shortcode has already run, so they provide no protection against server-side invocation.

The result is arbitrary execution of any registered WordPress shortcode, classified as CWE-94 (code injection), affecting all versions up to and including 10.8.1.

Why It Matters

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, network reachable, low complexity, no privileges, no user interaction, with high confidentiality and integrity impact. An attacker needs only to submit a rated comment containing a shortcode.

Once executed, the shortcode's output, attachment captions, private post fields, or whatever data installed shortcodes expose, is embedded in the page's JSON-LD reviewBody metadata and disclosed to every visitor loading that recipe page. Execution repeats on each render.

One condition gates exploitation: the attacker's rated comment must clear the site's comment approval threshold, either through auto-approval or a moderator action, before the injected shortcode starts firing.

What's Vulnerable

Sites running auto-approval for comments, or with active moderators who approve rated comments, are the most exposed.

Patch Status

The supplied NVD record lists a plugin changeset reference but does not name a fixed version, and this CVE does not appear in the CISA KEV catalog; there is no confirmation of active exploitation and no federal required-action deadline in the supplied data. The record was published 2026-09-19 with a status of Received. Operators should track the Wordfence and WordPress.org plugin trac references below for fix availability, and in the interim treat recipe-rating comment approval as a privileged action.

Sources