CVE-2026-89274

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2

Description An issue allows unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on recipe page renders. This occurs because the WPRM Metadata::sanitize metadata() function recursively calls do shortcode() on scalar fields of the recipe's structured metadata array, specifically the reviewBody field, without prior sanitization of shortcode tokens. The reviewBody field is populated from the comment content of approved wprm-comment-rating comments. Consequently, sensitive data exposed by installed shortcodes, such as private post fields or attachment captions, can be embedded in the page's JSON-LD reviewBody metadata and disclosed to visitors. Exploitation requires a rated comment to be approved by a moderator or via auto-approval.

Recommendations Update to a version newer than 10.8.1.