Arbitrary Shortcode Execution in WP Recipe Maker Plugin

The WP Recipe Maker plugin for WordPress contains a critical vulnerability (CVE-2026-89274) in its metadata sanitization logic. The function WPRM_Metadata::sanitize_metadata() recursively processes recipe structured metadata arrays by invoking do_shortcode() on scalar fields. Specifically, the reviewBody field is populated using the raw comment_content of user-submitted wprm-comment-rating comments. Because the plugin performs tag and shortcode stripping only after the do_shortcode() call has been executed, it fails to sanitize malicious shortcode tokens. This flaw permits unauthenticated attackers to trigger server-side execution of registered WordPress shortcodes when a recipe page is rendered. Successful exploitation allows for the disclosure of sensitive information, such as private post data or attachment details, which are then rendered into the page's JSON-LD metadata for all visitors to see. The exploit requires the malicious comment to be approved, either through site settings or human intervention.

Attack Chain

1. Attacker crafts a malicious comment containing a target WordPress shortcode.
2. Attacker submits the comment through the wprm-comment-rating input on a recipe page.
3. The WordPress site administrator or automated process approves the comment.
4. The WP Recipe Maker plugin processes the recipe metadata for display.
5. WPRM_Metadata::sanitize_metadata() pulls the raw comment_content into the reviewBody field.
6. The plugin calls do_shortcode() on the reviewBody string, executing the injected shortcode server-side.
7. The sensitive data rendered by the shortcode is stored in the JSON-LD structure of the recipe page.
8. Any visitor loading the recipe page receives the sensitive information within the page's JSON-LD output.

Impact

The vulnerability poses a significant risk of information disclosure across WordPress installations using the WP Recipe Maker plugin. Attackers can leverage this to exfiltrate private post content, system information, or other data exposed via shortcodes. By embedding this information in publicly accessible JSON-LD metadata, the attacker ensures the leaked data is visible to any browser loading the affected recipe page.

Recommendation

1. Upgrade the WP Recipe Maker plugin to a version beyond 10.8.1 immediately to resolve CVE-2026-89274.
2. Implement strict moderation policies for comments on recipe pages to prevent unapproved content from being rendered by the plugin.
3. Conduct an audit of all active shortcodes on the WordPress instance to identify those that could expose sensitive data if triggered via this vulnerability.