CVE-2026-89274: WP Recipe Maker RCE Vulnerability

CVE-2026-89274 Overview

CVE-2026-89274 is an arbitrary shortcode execution vulnerability in the WP Recipe Maker plugin for WordPress, affecting all versions up to and including 10.8.1. The flaw resides in WPRM_Metadata::sanitize_metadata(), which recursively invokes do_shortcode() on structured recipe metadata — including the reviewBody field derived from approved wprm-comment-rating comment content. Unauthenticated attackers can plant shortcode tokens in a rated comment that, once approved, execute server-side on every recipe page render. The classification maps to [CWE-94] Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can trigger execution of arbitrary registered WordPress shortcodes on recipe pages, exposing private post fields, attachment captions, and other data returned by installed shortcodes to all site visitors.

Affected Products

WP Recipe Maker plugin for WordPress — all versions through 10.8.1
WordPress sites that auto-approve comments or moderate approvals for wprm-comment-rating comment types
Sites with additional plugins exposing sensitive data through registered shortcodes

Discovery Timeline

2026-09-19 - CVE-2026-89274 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-89274

Vulnerability Analysis

The WP Recipe Maker plugin builds a JSON-LD structured data block for each recipe page. During construction, WPRM_Metadata::sanitize_metadata() walks every scalar element of the metadata array and passes the value through WordPress's do_shortcode() function. Values are only stripped of HTML tags and shortcode tokens after execution completes, meaning any post-processing occurs on the rendered output rather than the raw input.

One of the metadata fields, reviewBody, is populated verbatim from comment_content of approved wprm-comment-rating comments. An unauthenticated user submitting a rated comment therefore controls a value that will later be interpreted as shortcode source on every render of the parent recipe page. The vulnerability requires the comment to pass moderation, either through auto-approval or manual acceptance.

Root Cause

The root cause is unsafe evaluation of untrusted input as executable shortcode syntax. sanitize_metadata() treats structured metadata values as trusted strings and applies do_shortcode() before neutralization. The subsequent wp_strip_all_tags() and strip_shortcodes() calls operate on the already-expanded output and cannot undo execution side effects or prevent disclosure of shortcode return values.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction beyond comment moderation. An attacker submits a wprm-comment-rating comment containing arbitrary shortcode tokens targeting any shortcode registered by WordPress core or installed plugins. Once approved, the shortcode executes server-side on subsequent page loads and its output is embedded into the JSON-LD reviewBody field, making the returned data readable by any anonymous visitor of the recipe page.

See the WordPress Code Snippet Line 1028, WordPress Code Snippet Line 553, and WordPress Code Snippet Line 181 for the affected code paths.

Detection Methods for CVE-2026-89274

Indicators of Compromise

Approved wprm-comment-rating comments whose comment_content contains bracketed shortcode syntax such as [shortcode_name attr="value"].
Recipe page HTML source containing JSON-LD reviewBody values that include content not originally typed by the reviewer, such as file paths, attachment metadata, or private post excerpts.
Anonymous requests to recipe URLs shortly after new comments are approved on the same posts.

Detection Strategies

Query the wp_comments table for rows where comment_type = 'wprm-comment-rating' and comment_content matches the regex \[[a-zA-Z0-9_\-]+.
Compare rendered reviewBody output in the page's application/ld+json block against the raw comment_content for divergence indicating server-side expansion.
Enable WordPress debug logging for do_shortcode invocations originating from the WPRM metadata code path.

Monitoring Recommendations

Alert on new or modified wprm-comment-rating comments that contain [ characters pending moderation.
Monitor outbound traffic and file access originating from PHP-FPM workers during recipe page rendering for anomalous shortcodes performing network or filesystem operations.
Review web access logs for unauthenticated scraping patterns against /recipe/ or /?p= endpoints correlated with recent comment submissions.

How to Mitigate CVE-2026-89274

Immediate Actions Required

Update WP Recipe Maker to a version later than 10.8.1 that incorporates the fix referenced in the WordPress Changeset History.
Audit existing approved wprm-comment-rating comments and delete any containing shortcode tokens.
Set comment moderation to require manual approval for all recipe comments until the plugin is patched.

Patch Information

The vendor addressed the vulnerability in the changeset published at revision 3699793 in the WP Recipe Maker plugin repository. Additional analysis is available in the Wordfence Vulnerability Report. Administrators should upgrade to the fixed release and verify the version reported in the WordPress plugins dashboard.

Workarounds

Disable the WP Recipe Maker plugin until the site can be upgraded to a patched release.
Configure WordPress discussion settings to require manual approval for every comment and to hold comments containing [ for moderation.
Deregister sensitive shortcodes on public-facing sites, particularly those exposing private post fields, attachment data, or user information.

bash

# Configuration example: enforce manual comment moderation via WP-CLI
wp option update comment_moderation 1
wp option update comment_whitelist 0
wp option update moderation_keys "["