CVE-2026-89274 — WP Recipe Maker ≤ 10.8.1 Unauthenticated Shortcode Execution

September 25, 2026 · 371 views

Unauthenticated arbitrary shortcode execution in WP Recipe Maker (≤ 10.8.1) through approved recipe rating comments and **reviewBody** JSON-LD handling.

#wordpress#wp-recipe-maker#shortcode#unauthenticated

CVE:

CVE-2026-89274

Date:

2026-09-25

Severity:

HIGH

Exploit source

Full PoC repository on GitHub (public).

Description

Overview

CVE-2026-89274 targets WP Recipe Maker, a popular WordPress recipe plugin (≤ 10.8.1 in public write-ups). Untrusted input in the rating/comment pipeline (including JSON-LD reviewBody) can lead to shortcode execution without authentication.

Impact

Arbitrary shortcode execution often chains to remote code execution or sensitive data access depending on installed shortcodes and WordPress configuration. Recipe sites with public comment/rating features are typical exposure points.

Remediation

Update WP Recipe Maker to a patched version from the WordPress plugin directory or vendor. Restrict public ratings if an emergency workaround is needed while patching.

PoC tooling

The archived script validates plugin presence and demonstrates the issue in authorized lab environments.

Legal and ethical use

Use bundled tools only on WordPress sites you own or have written authorization to test. Unauthorized scanning or exploitation is illegal in most jurisdictions.

References

Look up the CVE ID on NVD and the CVE Program for official records.
Apply vendor/plugin updates from the official repository or vendor advisory before relying on any PoC.