EUVD-2026-83476
GHSA-x57m-9xmj-gh9p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network vector (PR:N), but AC:H because success depends on the comment clearing an out-of-attacker-control approval gate; impact is primarily disclosure (C:H), integrity only if a side-effecting shortcode exists (I:L), no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRM_Metadata::sanitize_metadata() recursively calls do_shortcode() on every scalar field of the recipe's structured metadata array - including the reviewBody field, which is populated verbatim from the comment_content of approved wprm-comment-rating comments - without sanitizing or stripping shortcode tokens before execution; the subsequent wp_strip_all_tags() and strip_shortcodes() calls operate only on the output string after execution has already fully occurred, providing no protection against server-side shortcode invocation. This makes it possible for unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on every recipe page render, causing shortcode output - such as attachment captions, private post fields, or other data exposed by installed shortcodes - to be embedded in the page's JSON-LD reviewBody metadata and disclosed to all visitors who load the recipe page. Successful exploitation requires the attacker's rated comment to pass the site's comment approval threshold, either via auto-approval or moderator action, before the injected shortcode begins executing on page loads.
Articles & Coverage 1
AnalysisAI
Shortcode injection in the WP Recipe Maker plugin for WordPress (all versions up to and including 10.8.1) lets an attacker plant arbitrary registered shortcode tokens inside the content of an approved wprm-comment-rating comment, which the plugin later feeds through do_shortcode() during recipe metadata generation and reflects into the JSON-LD reviewBody field served on every recipe page render. Because execution occurs before the plugin's strip_shortcodes()/wp_strip_all_tags() cleanup runs on the resulting string, output from sensitive shortcodes (attachment captions, private post fields, other data exposed by installed shortcodes) can be disclosed to any visitor loading the affected page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target site to use WP Recipe Maker (≤10.8.1) rendering recipe pages with JSON-LD structured metadata, and the site must accept wprm-comment-rating comments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) presents this as a critical unauthenticated network flaw, but that severity is inflated relative to the actual mechanism. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (changeset); released patched version not independently confirmed - the vendor repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3699793%40wp-recipe-maker&new=3699793%40wp-recipe-maker is the authoritative fix pointer, so upgrade WP Recipe Maker beyond 10.8.1 to the first release that contains it and verify the plugin no longer passes reviewBody (or any comment-derived metadata) through do_shortcode() before sanitization. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations for WP Recipe Maker 10.8.1 and earlier; if the plugin is not business-critical, deactivate and remove it immediately, and if it must remain, set all comments on recipe pages to require manual approval by trusted moderators and disable the wprm-comment-rating feature if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Recipe Maker
View allThe WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all
The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the 'recipes' parameter in all versions up t
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [wprm-recipe-inst
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipe Notes in all versions u
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in a
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wprm-recipe-round
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-recipe-text
The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in a
Stored cross-site scripting in the WP Recipe Maker plugin for WordPress affects all versions up to and including 10.8.1,
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip’ parameter in all
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today