# CVE-2026-89274: WP Recipe Maker arbitrary shortcode execution

Source: https://junglewise.ai/threats/cve-2026-89274-the-wp-recipe-maker-plugin-for-wordpress-is-vulnerable-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-19. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89274 · Severity: critical · CVSS 9.1 · Published 2026-09-19

The WP Recipe Maker plugin for WordPress allows unauthenticated attackers to execute arbitrary shortcodes on recipe pages by injecting shortcode tokens into approved comments. When the plugin renders recipe metadata, it executes these shortcodes before sanitizing the output, causing sensitive data—such as private post content or attachment information—to be embedded and exposed to all visitors in the page's structured metadata.

Technologies: [WP Recipe Maker](https://junglewise.ai/threats/technologies/wp-recipe-maker). Vendors: [WP Recipe Maker](https://junglewise.ai/threats/vendors/wp-recipe-maker).

## Quick answers

**Is CVE-2026-89274 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89274 being exploited in the wild.

**How severe is CVE-2026-89274?** Critical severity, with a CVSS score of 9.1, published 19 September 2026.

**Which products and versions are affected?** WP Recipe Maker up to and including 10.8.1.

**Is there a fix for CVE-2026-89274?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89274 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-89274?** Check whether you run WP Recipe Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in `WPRM_Metadata::sanitize_metadata()`, which recursively calls `do_shortcode()` on recipe metadata fields including `reviewBody` (populated from approved comment content) without pre-sanitization. Unauthenticated attackers can inject shortcode tokens into comments; upon moderation approval, the shortcodes execute server-side during page rendering, and their output is exposed in JSON-LD metadata. Post-execution sanitization via `wp_strip_all_tags()` and `strip_shortcodes()` provides no protection since code execution has already occurred.

## Affected products

- WP Recipe Maker WP Recipe Maker up to and including 10.8.1

## Timeline

- 2026-09-19: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.8.1/includes/public/class-wprm-metadata.php](https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.8.1/includes/public/class-wprm-metadata.php)
- [https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.8.1/includes/public/class-wprm-metadata.php](https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.8.1/includes/public/class-wprm-metadata.php)

## Related threats

- [WP Recipe Maker sensitive data disclosure in password-protected posts](https://junglewise.ai/threats/cve-2026-122060-the-wp-recipe-maker-wordpress-plugin-before-10-9-2-does-not)
- [WP Recipe Maker authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-86608-the-wp-recipe-maker-wordpress-plugin-before-10-8-2-does-not-have)
- [WP Recipe Maker information disclosure in AJAX action](https://junglewise.ai/threats/cve-2026-86603-the-wp-recipe-maker-wordpress-plugin-before-10-8-2-does-not-have)
- [WP Recipe Maker stored cross-site scripting in notes parameter](https://junglewise.ai/threats/cve-2026-90884-wp-recipe-maker-stored-cross-site-scripting-in-notes-parameter)
- [WP Recipe Maker authorization bypass in recipe ownership](https://junglewise.ai/threats/cve-2026-75905-wp-recipe-maker-authorization-bypass-in-recipe-ownership)