The WP Recipe Maker plugin is affected by a critical arbitrary shortcode execution vulnerability that allows unauthenticated attackers to exfiltrate sensitive site data via manipulated recipe comments.

This vulnerability arises from the improper handling of shortcodes within the WPRM_Metadata::sanitize_metadata() function. An unauthenticated attacker can inject shortcodes into recipe comments, which are then executed server-side when the metadata array is processed, leading to the disclosure of sensitive information within the JSON-LD output.

The vulnerability poses a severe risk to data confidentiality and integrity. By executing arbitrary shortcodes, an attacker can extract private post fields, attachment information, and other restricted content, potentially exposing intellectual property or sensitive user information. Given the CVSS score of 9.1, this represents a critical threat that could lead to significant reputational damage and unauthorized access to backend site data.

Immediate Action: Update the WP Recipe Maker plugin to version 10.8.2 or higher immediately to apply the necessary sanitization logic.

Proactive Monitoring: Review web server and WordPress application logs for unusual comment submissions or repeated attempts to trigger shortcode-related output in page metadata.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing common shortcode patterns or suspicious input in comment fields until the update can be applied.

Public Exploit Available: Yes, a public proof-of-concept exists in a GitHub repository.

The critical nature of this vulnerability, combined with its unauthenticated attack vector and the availability of a proof-of-concept, makes immediate remediation a priority. Administrators must update the WP Recipe Maker plugin to version 10.8.2 without delay to prevent unauthorized data exposure. Failure to patch leaves the site's structured metadata and potentially private content vulnerable to trivial extraction.