WP Recipe Maker Flaw Lets Attackers Run Shortcodes via Recipe Ratings

Executive Summary

A critical arbitrary shortcode execution vulnerability (CVE-2026-89274) has been disclosed in WP Recipe Maker, a WordPress recipe plugin installed on over 400,000 sites. The flaw is rated CVSS 9.1 and allows unauthenticated attackers to force the server to execute arbitrary registered shortcodes on every page load of an affected recipe.

CVSS Score: 9.1 (Critical)

The root cause is in WPRM_Metadata::sanitize_metadata(), which recursively calls do_shortcode() on every scalar field of a recipe's structured metadata — including the reviewBody field, populated verbatim from the comment_content of approved wprm-comment-rating comments. The plugin never strips shortcode syntax before invoking do_shortcode(); its later calls to wp_strip_all_tags() and strip_shortcodes() only clean the output after the shortcode has already executed, offering no real protection.

Vulnerability Overview

Affected Versions

Attack Vector

1. Attacker submits a rating comment on a recipe using the wprm-comment-rating feature
2. Comment content contains a malicious shortcode, e.g. a shortcode exposing private data
3. Comment clears moderation (auto-approval, or a moderator approves it)
4. On every subsequent page render, sanitize_metadata() copies comment_content into reviewBody
5. do_shortcode() executes the embedded shortcode server-side before any sanitization runs
6. Shortcode output is embedded in the page's JSON-LD reviewBody metadata, visible to all visitors

Because the injected shortcode runs server-side and its output lands in structured metadata rather than rendered HTML, the attack can quietly leak data exposed by other installed shortcodes — attachment captions, private post fields, or anything else a registered shortcode can output — to every visitor and to search engines crawling the page's structured data.

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update to Version 10.8.2

# Via WP-CLI
wp plugin update wp-recipe-maker
 
# Verify the installed version
wp plugin get wp-recipe-maker --field=version

Or update through WordPress admin: Plugins > Installed Plugins > WP Recipe Maker > Update Now.

Step 2: Audit Existing Approved Comments

# Search recent wprm-comment-rating comments for shortcode syntax
wp comment list --type=comment --status=approve --format=csv | grep -i '\[.*\]'

Manually review and remove any approved recipe rating comments containing bracketed shortcode-like syntax.

Step 3: Tighten Comment Moderation

1. Navigate to Settings > Discussion
2. Disable comment auto-approval if currently enabled
3. Require manual moderator approval for all new comments

If Immediate Patching Is Not Possible

1. Disable the recipe rating/comment feature in WP Recipe Maker settings if not essential
2. Enable strict comment moderation to prevent auto-approval of malicious content
3. Monitor JSON-LD output on recipe pages for unexpected shortcode artifacts

Detection Indicators

Post-Remediation Steps

1. Confirm plugin updated to 10.8.2 or later
2. Purge and re-review all approved rating comments for injected shortcodes
3. Re-enable strict moderation for future comment submissions
4. Check search engine caches for any leaked structured data
5. Deploy a WAF to catch shortcode-pattern payloads in comment submissions

References

• Wordfence Intelligence — WP Recipe Maker Vulnerabilities
• NIST NVD — CVE-2026-89274

Related Reading

• Gravity Forms Unauthenticated File Upload Lets Attackers Achieve RCE
• Forminator Forms Shortcode Execution via Quiz Parameter
• CVE-2026-3589: WooCommerce CSRF Flaw Allows Unauthenticated