A vulnerability in the WP Recipe Maker plugin for WordPress, tracked as CVE-2026-89274, allows unauthenticated attackers to execute arbitrary shortcodes server-side. Every version up to and including 10.8.1 is affected. If your organization runs WordPress sites with this plugin, including recipe or content-heavy properties, you're in scope.

Here's the core issue. The plugin's WPRM_Metadata::sanitize_metadata() function calls do_shortcode() on every scalar field in a recipe's structured metadata, including the reviewBody field. That field pulls directly from approved comment content. So an attacker submits a comment containing a shortcode token, gets it approved (or finds a site with permissive comment settings), and on every subsequent page render the server executes that shortcode and embeds its output into the page's JSON-LD block. The sanitization calls that follow, wp_strip_all_tags() and strip_shortcodes(), run after execution has already completed. They clean up the string but they can't un-ring the bell.

The IAM angle here is data exposure through indirect execution. Shortcodes in WordPress can surface attachment metadata, post fields, user-authored content, or whatever any installed plugin registers. If you've got shortcodes that touch private content, internal fields, or anything gated by post status rather than session-based access control, that data can leak to every anonymous visitor who loads the recipe page. This isn't a login bypass, but it's a privilege escalation of a different kind: unauthenticated read access to data your architecture assumed was protected by visibility controls.

What makes this worse operationally is the comment approval dependency. Sites that auto-approve comments from users with a prior approved comment are far more exposed. An attacker who gets one benign comment through the door can follow up with a payload comment on any recipe. Sites treating comment approval as a trust elevation mechanism without any content inspection are relying on a control that was never designed to catch this.

Update to a patched version of WP Recipe Maker immediately. If you can't patch right now, disable the plugin or restrict comment submission on recipe post types. While you're at it, audit what shortcodes are registered across your WordPress environment and what data they can surface without authentication context. If any shortcode can return content that isn't meant for anonymous users, that's a gap worth closing regardless of this CVE.