WP Recipe Maker before version 10.8.2 fails to remove shortcodes from comment content when generating a page’s structured metadata, enabling arbitrary shortcodes to execute on the server. This issue represents a CWE-74 weakness. An unauthenticated user can embed malicious shortcodes in a comment, which the plugin processes as if they were part of the page, potentially allowing code execution or the exposure of unpublished recipes.

Any WordPress site running WP Recipe Maker plugin version 10.8.2 or earlier is affected. The vulnerability applies to all installations that have the old plugin active and do not restrict comment posting to authenticated users.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting no current large‑scale exploitation reports. The attack requires only that an unauthenticated user be able to post a comment, after which the server processes the shortcodes when constructing metadata. This path can lead to server‑side code execution or unintended data disclosure if the site hosts unpublished content.