CVE-2025-11755: WP Delicious Recipe Plugin RCE Flaw

CVE-2025-11755 Overview

CVE-2025-11755 affects the WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) for WordPress. The plugin allows arbitrary file uploads through the CSV recipe import feature in all versions up to and including 1.9.0. An authenticated attacker with Contributor-level permissions or higher can supply a remote URL during the recipe import process to upload a malicious PHP file. Successful exploitation leads to Remote Code Execution (RCE) on the underlying WordPress host. The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Contributor-level WordPress accounts can achieve full Remote Code Execution by importing a CSV that references a remote PHP payload.

Affected Products

WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) for WordPress
All versions up to and including 1.9.0
WordPress sites permitting Contributor-level or higher accounts

Discovery Timeline

2025-11-01 - CVE-2025-11755 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11755

Vulnerability Analysis

The vulnerability resides in the REST API endpoint implemented in class-delicious-recipes-rest-import-recipe-terms-controller.php. The plugin exposes a CSV recipe import workflow that accepts remote URLs as values for media or attachment fields. The import logic fetches these URLs and writes the retrieved content into the WordPress uploads directory. The handler does not enforce a file-type allowlist that excludes server-executable extensions such as .php. An attacker with Contributor permissions can submit a CSV row referencing a remote PHP payload. The plugin downloads the payload, stores it under a web-accessible path, and the attacker requests the resulting URL to execute arbitrary code in the WordPress process context.

Root Cause

The root cause is missing validation of the MIME type and file extension during remote-fetch ingestion in the CSV import controller. The plugin trusts the remote URL and writes the response body to disk without sanitizing the resulting filename or rejecting executable types, violating CWE-434.

Attack Vector

Exploitation is network-based and requires Contributor-level authentication, which is broadly available on multi-author WordPress sites. The attacker hosts a malicious PHP file on an attacker-controlled server, then submits a recipe import CSV that references that URL. After import, the attacker requests the uploaded PHP file directly to trigger RCE. No user interaction is required beyond the attacker's authenticated session. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the affected handler.

Detection Methods for CVE-2025-11755

Indicators of Compromise

Unexpected .php files written under wp-content/uploads/ shortly after a recipe import action.
POST requests to the WP Delicious REST import endpoint originating from Contributor or Author accounts.
Outbound HTTP fetches from the WordPress host to attacker-controlled URLs during import operations.
New or modified administrator accounts created shortly after an import event.

Detection Strategies

Inspect web server access logs for direct GET requests to PHP files inside wp-content/uploads/ and its subdirectories.
Alert on REST API calls to the Delicious Recipes import routes from non-administrator users.
Compare file inventories of the uploads directory against baseline to surface executable file types.

Monitoring Recommendations

Forward WordPress audit logs and web server logs to a centralized analytics platform for correlation with outbound network traffic.
Monitor PHP process lineage for child processes spawned from the web server user that match shell or reconnaissance binaries.
Track creation of files with executable extensions in upload directories using file integrity monitoring.

How to Mitigate CVE-2025-11755

Immediate Actions Required

Update WP Delicious – Recipe Plugin to a version later than 1.9.0 as soon as the vendor publishes a fixed release.
Audit existing Contributor, Author, and Editor accounts and revoke or reset any that are unused or suspicious.
Search wp-content/uploads/ for unexpected .php, .phtml, or .phar files and remove them after forensic capture.

Patch Information

Review the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the latest fix status. Apply the vendor-released update for WP Delicious to a version above 1.9.0 once published. No fixed version is referenced in the NVD record at the time of writing.

Workarounds

Restrict the recipe import capability to administrators only by removing CSV import permissions from lower-privileged roles.
Configure the web server to deny execution of PHP within wp-content/uploads/ using an .htaccess rule or equivalent Nginx directive.
Block outbound HTTP requests from the WordPress server to untrusted hosts so the import handler cannot fetch arbitrary remote URLs.

bash

# Apache: prevent PHP execution inside the uploads directory
# Place this file at wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php7|phps)$">
    Require all denied
</FilesMatch>