WordPress Plugin Vulnerabilities

WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

Description

The plugin does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.

Proof of Concept

Affects Plugins

Plugin icon
wp-recipe-maker
Fixed in 10.8.2

References

CVE
CVE-2026-86601

Classification

Type
INJECTION
OWASP top 10
A1: Injection
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Jakub Herman
Submitter
Jakub Herman
Submitter website
https://jakubherman.net
Verified
Yes
WPVDB ID
be6b1fb1-222d-4563-8a19-41bed1960001

Timeline

Publicly Published
2026-09-21 (about 2 days ago)
Added
2026-09-21 (about 1 day ago)
Last Updated
2026-09-21 (about 1 day ago)

Other

Published
Title
Published
2026-06-02
Title
Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure
Published
2026-09-21
Title
Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
Published
2020-03-04
Title
Appointment Booking Calendar < 1.3.35 - CSV Injection
Published
2026-09-07
Title
Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
Published
2026-09-21
Title
Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source