Back to the CVE list
CVE-2026-89274Suited to automated attack · CISA

WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

CVSS score

9.1

EPSS probability

%0.7

Risk score

0.1

Published

1 mo ago

OverviewPublic Exploits (3)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
murrez/CVE-2026-89274
GitHub

PoC for CVE-2026-89274: unauthenticated arbitrary shortcode execution in WP Recipe Maker ≤10.8.1 via recipe rating comments (JSON-LD). Python check/exploit/verify. (★0)

Public PoCSource updated: 20.09.2026 05:26:26
G
Polosss/By-Poloss..-.CVE-2026-89274
GitHub

Unauthenticated Arbitrary Shortcode Execution (★0)

Public PoCSource updated: 21.09.2026 01:56:52
G
Hassham1/CVE-2026-89274-wp-recipe-maker-poc
GitHub

CVE-2026-89274 — WP Recipe Maker <= 10.8.1 arbitrary shortcode execution via rating-comment reviewBody (CVSS 9.1): Docker validation lab with vulnerable (10.8.1) vs patched (10.8.2) controls, Python PoC proving server-side shortcode execution in recipe JSON-LD, nuclei version screen. Authorized security research only. (★0)

Public PoCSource updated: 24.09.2026 01:29:11

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-89274"