CVE-2026-89274 — WP Recipe Maker ≤ 10.8.1 Unauthenticated Shortcode Execution
Unauthenticated arbitrary shortcode execution in WP Recipe Maker (≤ 10.8.1) through approved recipe rating comments and **reviewBody** JSON-LD handling.
Description
Overview
CVE-2026-89274 targets WP Recipe Maker, a popular WordPress recipe plugin (≤ 10.8.1 in public write-ups). Untrusted input in the rating/comment pipeline (including JSON-LD reviewBody) can lead to shortcode execution without authentication.
Impact
Arbitrary shortcode execution often chains to remote code execution or sensitive data access depending on installed shortcodes and WordPress configuration. Recipe sites with public comment/rating features are typical exposure points.
Remediation
Update WP Recipe Maker to a patched version from the WordPress plugin directory or vendor. Restrict public ratings if an emergency workaround is needed while patching.
PoC tooling
The archived script validates plugin presence and demonstrates the issue in authorized lab environments.
Legal and ethical use
Use bundled tools only on WordPress sites you own or have written authorization to test. Unauthorized scanning or exploitation is illegal in most jurisdictions.
References
- Look up the CVE ID on NVD and the CVE Program for official records.
- Apply vendor/plugin updates from the official repository or vendor advisory before relying on any PoC.