By-Poloss..-.CVE-2026-89274

CVE-2026-89274 PoC Poloss : @WPEF0 CVE-2026-89274 の Proof-of-Concept エクスプロイト — WordPress プラグイン WP Recipe Maker バージョン ≤ 10.8.1 における Unauthenticated Arbitrary Shortcode Execution 脆弱性。 ⚠️ 法的・倫理的警告 このスクリプトはローカル環境（localhost/ラボ）でのセキュリティ研究のみ を目的として提供されており、ご自身が所有していないシステム、または書面による許可のないシステムに対して使用してはなりません...

CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker 任意ショートコード実行 検証ラボ CVE-2026-89274 を再現・検証するためのセキュリティリサーチ資料: WP Recipe Maker 自身が所有するシステム、または明示的にテストを許可されたシステムでのみ使用すること。 この PoC は、ラボで登録されたマーカーショートコードを含む評価コメントを 1 件投稿する。 破壊的なショートコードは使用せず、ディスクへの書き込みも行わない。 判定 ステータス: 提供されたラボで実証済み。 WP Recipe Maker 10.8.1 WordPress...

CVE-2026-89274

CVE-2026-89274 — WP Recipe Maker 任意ショートコード実行 WP Recipe Maker における CVE-2026-89274 の Python 3 による PoC スキャナ/エクスプロイト。 | ---|--- プラグイン| wp-recipe-maker 影響を受けるバージョン| ≤ 10.8.1 修正バージョン| 10.8.2+ CVSS| 9.1 Critical 認証| 不要 コメント投稿 CWE| CWE-94 概要 WPRMMetadata::sanitizemetadata は、メタデータフィールドに対して stripshortcodes...

Exploit for CVE-2026-89274

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution...

CVE-2026-86601

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

CVE-2026-86601

The WP Recipe Maker WordPress plugin, in versions prior to 10.8.2 , is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the failure to remove shortcodes from comment content before expanding them during the generation of a page's structured metadata . This flaw allo...

CVE-2026-86601 WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

EUVD-2026-85188

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

CVE-2026-86601 WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

CVE-2026-86608

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2026-86602

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

CVE-2026-86603

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

CVE-2026-86608 WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

EUVD-2026-85044

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2026-86608

The WP Recipe Maker WordPress plugin (versions 9.8.0-10.8.1 ) is vulnerable to an unauthenticated Denial of Service (DoS) . The flaw exists because one of the plugin's REST routes lacks proper authorization checks and fails to bound the data it stores. This allows unauthenticated attackers to wri...

WordPress WP Recipe Maker plugin 9.8.0-10.8.1 - Unauthenticated DoS vulnerability

Unauthenticated DoS vulnerability discovered by Isuka sanuj in WordPress Plugin WP Recipe Maker versions 9.8.0-10.8.1...

CVE-2026-86608 WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

WordPress WP Recipe Maker plugin < 10.8.2 - Subscriber+ Non-Public List Title Disclosure vulnerability

Subscriber+ Non-Public List Title Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin WP Recipe Maker versions 10.8.2...

WordPress WP Recipe Maker plugin 10.3.0-10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure vulnerability

Subscriber+ Draft and Private Recipe Content Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin WP Recipe Maker versions 10.3.0-10.8.1...

CVE-2026-86602 WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...