WP Recipe Maker EUVD-2026-85188

Requires a WordPress site running WP Recipe Maker before 10.8.2 with comments enabled on pages where the plugin generates structured recipe metadata, since the flaw is that comment content is shortcode-expanded during metadata building without stripping shortcodes. Exploitation is unauthenticated and needs no user interaction (PR:N/UI:N), but the confidentiality payoff (reading unpublished recipes) is limited to sites that actually have unpublished recipe content, and the server-side execution is bounded to shortcodes registered/available on the target site rather than arbitrary code.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction and low confidentiality and integrity impact. A public exploit exists (WPScan advisory flagged as 'exploit'), so this counts as 'publicly available exploit code exists' - but there is NO EPSS score and NO CISA KEV entry in the input, so there is no evidence of active in-the-wild exploitation; treat POC availability and exploitation as distinct signals. The 'RCE' tag materially overstates impact: the vendor-scored vector caps confidentiality and integrity at Low (C:L/I:L, A:N), which is inconsistent with true remote code execution (which would warrant C:H/I:H/A:H). The real-world effect is server-side execution of WHATEVER shortcodes are registered on the site plus disclosure of unpublished recipe content - meaningful but bounded, not arbitrary native code execution. This is a moderate-priority patch for sites running the affected plugin, given the unauthenticated network vector and available POC, rather than an emergency, and the missing EPSS/KEV data means widespread mass-exploitation is not currently substantiated.

An unauthenticated visitor submits a comment containing WordPress shortcodes on a page served by WP Recipe Maker; when the plugin builds the page's structured (recipe) metadata it expands the comment content without stripping shortcodes, causing those shortcodes to execute server-side and to surface the content of unpublished recipes back to the attacker. A public exploit is referenced by WPScan, and the CVSS AV:N/AC:L/PR:N/UI:N vector confirms this requires only remote, low-complexity, unauthenticated access.