CVE-2026-86601: WP Recipe Maker WordPress RCE Vulnerability

CVE-2026-86601 Overview

CVE-2026-86601 affects the WP Recipe Maker WordPress plugin in versions prior to 10.8.2. The plugin fails to strip shortcodes from comment content before expanding it during the construction of a page's structured metadata. Unauthenticated attackers can submit comments containing arbitrary shortcodes that the server later executes. Exploitation allows adversaries to read the content of unpublished recipes and trigger any shortcode registered on the site. The flaw is classified under CWE-74 as improper neutralization of special elements in output used by a downstream component.

Critical Impact
Unauthenticated attackers can execute arbitrary WordPress shortcodes server-side through comment content, exposing unpublished recipe data and any information accessible via installed shortcodes.

Affected Products

WP Recipe Maker WordPress plugin versions prior to 10.8.2
WordPress sites accepting unauthenticated comments on pages using WP Recipe Maker
Sites where WP Recipe Maker generates structured metadata that incorporates comment content

Discovery Timeline

2026-09-23 - CVE-2026-86601 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86601

Vulnerability Analysis

The vulnerability resides in the shortcode-handling logic used when WP Recipe Maker builds structured metadata for a page. During this process, the plugin expands the content of comments to include it in the generated metadata. It does not strip or neutralize shortcodes present in that comment content before invoking WordPress's shortcode expansion routine.

An attacker who submits a comment can embed arbitrary shortcodes. When the server renders the page and generates structured metadata, WordPress evaluates those shortcodes with server-side privileges. This grants the attacker the ability to invoke any shortcode registered on the site, including shortcodes tied to premium or unpublished recipe content.

The reported impact includes reading the content of unpublished recipes. Because the executed shortcodes run in the server context, the disclosure surface extends to any data reachable through installed shortcode handlers.

Root Cause

The root cause is missing input neutralization prior to a downstream interpretation step. Comment content flows into the shortcode parser without a call to strip_shortcodes() or an equivalent sanitizer. This matches the CWE-74 pattern of failing to neutralize special elements before passing data to a component that treats them as control tokens.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker submits a comment containing a target shortcode, such as one that renders a private or unpublished recipe. When the page is loaded and WP Recipe Maker constructs the structured metadata, the shortcode expands server-side and its output is exposed. For technical specifics, refer to the WPScan Vulnerability Report.

Detection Methods for CVE-2026-86601

Indicators of Compromise

Comments in the WordPress database containing shortcode syntax such as [wprm-recipe] or other registered shortcode tags
Unexpected recipe content appearing inside structured data blocks or JSON-LD metadata on public pages
Access log entries showing repeated POST requests to wp-comments-post.php from a single source followed by GET requests to the associated post

Detection Strategies

Query the wp_comments table for comment_content values containing bracketed shortcode patterns submitted by unauthenticated users
Compare rendered page output against expected recipe visibility state to identify structured metadata referencing unpublished posts
Review WP Recipe Maker version inventory across managed WordPress sites and flag installations below 10.8.2

Monitoring Recommendations

Alert on WordPress comment submissions containing shortcode delimiters from unauthenticated sources
Monitor outbound rendering of JSON-LD or microdata blocks for content matching unpublished post identifiers
Track plugin version drift and integrate WordPress plugin CVE feeds into vulnerability management workflows

How to Mitigate CVE-2026-86601

Immediate Actions Required

Update the WP Recipe Maker plugin to version 10.8.2 or later on all WordPress installations
Audit existing comments for embedded shortcodes and remove or sanitize suspicious entries
Review recently rendered page metadata for exposure of unpublished recipe content and rotate any sensitive data that may have leaked

Patch Information

The vendor addressed the issue in WP Recipe Maker version 10.8.2 by stripping shortcodes from comment content before it is expanded during structured metadata generation. See the WPScan Vulnerability Report for advisory details.

Workarounds

Disable comments on posts and pages that use WP Recipe Maker until the patched version is deployed
Require comment moderation for all unauthenticated submissions and reject any comment containing bracketed shortcode syntax
Temporarily deactivate the WP Recipe Maker plugin if patching cannot be completed promptly

bash

# Update WP Recipe Maker via WP-CLI
wp plugin update wp-recipe-maker --version=10.8.2
wp plugin list --name=wp-recipe-maker --fields=name,status,version