This flaw permits an attacker with Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import via CSV, enabling remote code execution. The vulnerability stems from inadequate file type validation (CWE-434) and allows execution of arbitrary code on the host server. The impact results in full compromise of the affected site if the attacker succeeds.

All versions of WP Delicious – Recipe Plugin for Food Bloggers up to and including 1.9.0 are affected. The plugin is a WordPress plugin used by food bloggers to import recipes using CSV files. WordPress installations that include this plugin with Contributor or higher roles are vulnerable.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1 % suggests a low probability of exploitation at this moment, though the lack of known exploitation may reflect limited demand or detection. The flaw is not currently listed in the CISA KEV catalog. An attacker must authenticate as a Contributor or higher to use the import feature, so the attack path requires legitimate access; however, once authenticated the exploit path is straightforward: upload a sanitized PHP file to be placed in the upload directory and trigger its execution via a crafted request or by accessing the file directly.