VulnSocial

CVE-2026-89274PoC

MEDIUMCVSS 9.1 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because `WPRM_Metadata::sanitize_metadata()` recursively calls `do_shortcode()` on every scalar field of the recipe's structured metadata array — including the `reviewBody` field, which is populated verbatim from the `comment_content` of approved `wprm-comment-rating` comments — without sanitizing or stripping shortcode tokens before execution; the subsequent `wp_strip_all_tags()` and `strip_shortcodes()` calls operate only on the output string after execution has already fully occurred, providing no protection against server-side shortcode invocation. This makes it possible for unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on every recipe page render, causing shortcode output — such as attachment captions, private post fields, or other data exposed by installed shortcodes — to be embedded in the page's JSON-LD `reviewBody` metadata and disclosed to all visitors who load the recipe page. Successful exploitation requires the attacker's rated comment to pass the site's comment approval threshold, either via auto-approval or moderator action, before the injected shortcode begins executing on page loads.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 5 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 4 signals
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 1 classified signal
  • Peaked 3d ago at 2 mentions (2026-09-19); latest day: 1
  • 5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d
01122Mentions · 2026-09-19: 2Mentions · 2026-09-20: 1Mentions · 2026-09-24: 1Mentions · 2026-09-27: 1PoC Mentioned / Linked · 2026-09-19: 1PoC Mentioned / Linked · 2026-09-20: 1PoC Mentioned / Linked · 2026-09-24: 1PoC Mentioned / Linked · 2026-09-27: 1Exploit Tool / Code · 2026-09-20: 1Exploit Tool / Code · 2026-09-27: 1Patch / Workaround · 2026-09-19: 1Patch / Workaround · 2026-09-20: 1Technical Details · 2026-09-19: 1Technical Details · 2026-09-20: 1Technical Details · 2026-09-24: 1Technical Details · 2026-09-27: 109-1909-2009-2409-27
Signal classification3 categories
PoC
360.0%
Patch
120.0%
Disclosure
120.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-192
Patch1PoC1
2026-09-201
PoC1
2026-09-241
Disclosure1
2026-09-271
PoC1
Full discourse5 posts
  • Rıdvan Yağlı@ridvanyagli
    PoC

    🔴 CVE-2026-89274 - WordPress WP Recipe Maker eklentisi için PoC yayınlandı. WordPress WP Recipe Maker eklentisinin ≤10.8.1 sürümlerini etkileyen kritik Arbitrary Shortcode Execution açığı, onaylanan tarif derecelendirme yorumları üzerinden shortcode çalıştırılmasına yol açabiliyor. CVSS: 9.1 Critical Yamalanmış sürüm: 10.8.2+ https://github.com/murrez/CVE-2026-89274

    Post summary

    The tweet announces the release of a Proof of Concept for CVE-2026-89274, a critical arbitrary shortcode execution vulnerability in the WordPress WP Recipe Maker plugin, and notes the fixed version 10.8.2.

    0201561.5K
    2.5K followersView on X
  • Ryx@PadhiyarRushi
    PoC

    WP Recipe Maker runs "do_shortcode()" on recipe comments, then strips tags after the damage is done!! CVE-2026-89274 (CVSS 9.1). ≤10.8.1 "WPRM_Metadata::sanitize_metadata()" recursively shortcode-parses every scalar, including "reviewBody" from approved "wprm-comment-rating" comments. "wp_strip_all_tags()" / "strip_shortcodes()" run on the output after execution. Unauth comment + approval (or auto-approve) → arbitrary shortcodes on every recipe page render, dumped into JSON-LD. Public PoC on GitHub! https://github.com/murrez/CVE-2026-89274 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #WordPress #BugBounty #AppSec

    Post summary

    The text announces a critical vulnerability in WP Recipe Maker (CVE-2026-89274) with a CVSS of 9.1, detailing the technical exploit chain and highlighting the availability of a public Proof of Concept on GitHub.

    01051343
    954 followersView on X
  • mürrez@murrezsec
    PoC

    Just released the PoC for CVE-2026-89274! 🚨 🛡️ Details & PoC: https://github.com/murrez/CVE-2026-89274 #CyberSecurity #Infosec #PoC #Vulnerability #Exploit

    Post summary

    The tweet announces the release of a PoC for CVE-2026-89274 and shares a GitHub link, without mentioning exploit tools, patches, or active exploitation.

    00030119
    636 followersView on X
  • ADK Cyber@ADKCyber
    Patch

    CVE-2026-89274 (CVSS 9.1): WP Recipe Maker plugin vulnerable to Arbitrary Shortcode Execution through 10.8.1. Update immediately if this plugin is active. https://nvd.nist.gov/vuln/detail/CVE-… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/4eXRbvsnjD

    Post summary

    The tweet discloses CVE-2026-89274 affecting WP Recipe Maker plugin versions through 10.8.1 with a CVSS of 9.1 involving arbitrary shortcode execution, and explicitly urges users to update immediately. This results in a 'Patch' classification due to the named fix/upgrade directive.

    1000033
    97 followersView on X
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Disclosure

    CVE-2026-89274: WP Recipe Maker plugin RCE via shortcode injection, CVSS 9.1, no patch yet. Update immediately. https://www.valtersit.com/cve/CVE-2026-89274 #CVE #WordPress #infosec #WPRecipeMaker #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text discloses a high-severity RCE vulnerability (CVE-2026-89274) in the WP Recipe Maker plugin, including technical details and a CVSS score, while noting the absence of an available patch.

    0000043
    1.1K followersView on X

Explore more

Back to dashboard