Loading vulnerability…
CVE-2026-89274 is an unauthenticated arbitrary WordPress shortcode-execution vulnerability in WP Recipe Maker through version 10.8.1. The flaw is in WPRM_Metadata::sanitize_metadata(), which recursively invokes do_shortcode() on scalar recipe-metadata values. The affected reviewBody value is derived verbatim from the comment content of approved recipe-rating comments. Shortcodes therefore execute before later tag and shortcode stripping is applied to the resulting output. A crafted shortcode in an approved rating comment executes whenever its associated recipe page is rendered, and its output can be incorporated into the page's JSON-LD reviewBody metadata.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This nine-file repository is an authorized validation lab and functional Python PoC for CVE-2026-89274 in WP Recipe Maker <= 10.8.1. The vulnerability occurs when approved, rated comments are incorporated into recipe JSON-LD reviewBody metadata: the plugin applies do_shortcode() before stripping shortcode tags, causing registered WordPress shortcodes in comment content to execute server-side during page rendering. The result is embedded in metadata and disclosed to visitors. It does not establish generic RCE; impact depends on shortcodes registered by WordPress or other plugins. The primary exploit is poc/poc_cve_2026_89274.py. It optionally discovers a recipe through the WordPress REST API, submits [cve89274] with wprm-comment-rating=5 to wp-comments-post.php, waits briefly for approval, and fetches the rendered post to locate CVE89274-SHORTCODE-FIRED. Its payload is intentionally benign and only fires in the supplied lab because lab registers a marker shortcode. Although some PoC comments describe a recipe post ID, the lab provisions a recipe embedded in a parent post and passes that parent post ID to the PoC, consistent with the documented affected metadata path. The lab Bash driver provisions vulnerable (10.8.1) and patched (10.8.2) Docker environments using WordPress 7.1.2, MySQL 8.0, WP-CLI, auto-approved comments, and a local marker mu-plugin. It verifies both the vulnerable positive control and patched negative control. docker-compose.yml exposes WordPress only on loopback. The Nuclei YAML is not behavioral exploitation: it performs one GET request to the public plugin readme.txt and version-screens for Stable tag <= 10.8.1. GitHub Actions runs the lab's vulnerable/patched verification matrix.
This five-file repository is a standalone Python 3 proof-of-concept scanner and exploit for the claimed CVE-2026-89274 flaw in WP Recipe Maker versions through 10.8.1. Its sole code file, `poc.py` (about 36 KB), uses `requests` and `urllib3`; `README.md` documents use, `requirements.txt` lists dependencies, and `targets.example.txt` supplies an example input-list format. The tool normalizes target URLs, disables TLS certificate verification, performs plugin/version detection via WP Recipe Maker plugin files and page assets, crawls likely recipe paths, and identifies pages with a `wprm-comment-rating` form. In exploit mode it submits crafted comment content containing a configurable WordPress shortcode, with optional Premium REST-path attempts as documented. Verification mode re-fetches a recipe page and searches structured JSON-LD reviewBody content for a marker/shortcode reflection. The repository contains no fixed victim hosts, callback infrastructure, reverse shell, or destructive behavior; example domains are placeholders. It is a functional exploitation tool, not merely a detector, although its demonstrated impact is shortcode execution/output reflection and is contingent on the injected comment being approved.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An arbitrary shortcode-execution vulnerability in WP Recipe Maker for WordPress through version 10.8.1. Approved rating comments can inject shortcode tokens into recipe metadata; the plugin executes them server-side during recipe-page rendering before attempting to strip shortcodes, potentially disclosing shortcode output in public JSON-LD reviewBody metadata.
A critical unauthenticated arbitrary WordPress shortcode execution vulnerability in WP Recipe Maker through version 10.8.1. Approved attacker-controlled recipe comments reach WPRM_Metadata::sanitize_metadata(), which invokes do_shortcode() before stripping shortcode text. This can execute registered server-side shortcodes and disclose their output to recipe-page visitors. Exploitation requires the malicious rating comment to be approved, either automatically or by a moderator.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.