{"vulnerability": "cve-2026-89274", "sightings": [{"uuid": "fdf0e26b-fcb6-46fb-95c4-45ff172420f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-89274", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117295469276201522", "content": "WP Recipe Maker <=10.8.1 hit by CVE-2026-89274: CRITICAL code injection via unsanitized shortcodes in comment ratings. Unauthenticated attackers can trigger arbitrary shortcode execution on recipe pages. Upgrade ASAP. https://radar.offseq.com/threat/cve-2026-89274-cwe-94-improper-control-of-generation-of-code-code-injection-in-brechtvds-wp-recipe-77a2426acb987f3a #OffSeq #WordPress #CVE202689274 #Infosec", "creation_timestamp": "2026-09-19T03:00:24.336980Z"}, {"uuid": "5ef33868-e6fd-460c-b7ce-eb9fcdafe028", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-89274", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvtovz5m6n2e", "content": "WP Recipe Maker up to 10.8.1 is vulnerable (CVE-2026-89274, CRITICAL). Attackers can inject malicious shortcodes via approved comments. Update your plugin and review comment moderation settings. https://radar.offseq.com/threat/cve-2026-89274-cwe-94-improper-control-of-generation-of-code-code-inje...", "creation_timestamp": "2026-09-19T03:00:28.656957Z"}, {"uuid": "812d9a08-77fc-445a-8be6-eab93899a37b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvtsnruebc2r", "content": "\ud83d\udea8 CVE-2026-89274 \u2014 CVSS 9.1 CRITICAL\n\nThe WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89274\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-19T04:07:25.163044Z"}, {"uuid": "684ebba1-b869-40a2-896f-ba4f2625f96f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mvtvoxh6cl2g", "content": "Daily IT Security Digest \u2014 2026-09-19\n# Daily IT Security Digest \u2014 2026-09-19\n\n1. **WP Recipe Maker: Critical Code Injection (CVE-2026-89274)**\n   WordPress plugin WP Recipe Maker (\u226410.8.1) is vulnerable to unauthenticated arbitrary shortcode execution via unsanitized shortcodes in recipe comment", "creation_timestamp": "2026-09-19T05:01:45.763261Z"}, {"uuid": "b5b9393f-f2d3-40cf-84f4-502eacb342df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-89274", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mvtvoxpiyd2u", "content": "Daily IT Security Digest \u2014 2026-09-19\nAttackers can trigger arbitrary shortcode execution on recipe pages without authentication. Upgrade to the latest version immediately.\n   \u2014 Source: [offseq](https://radar.offseq.com/threat/wp-recipe-maker-cve-2026-89274),", "creation_timestamp": "2026-09-19T05:01:46.285630Z"}, {"uuid": "8663b018-7b22-487d-9bcf-368c85d9bc62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvu36redsw25", "content": "CVE-2026-89274\nThe WP Recipe Maker plugin for WordPress lets anyone who can post a comment that gets approved add code that runs on every recipe page. This could cause hidden data or other site content to be shown to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-19T06:40:05.326625Z"}, {"uuid": "e0bde1d7-6d9b-498b-b0a2-b548da5b3198", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvu4kqj7ab2s", "content": "\ud83d\udd34 CVE-2026-89274 - Critical (9.1)\n\nThe WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all ve...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-89274/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-19T07:04:41.179869Z"}, {"uuid": "b503b5ef-f232-4aa3-80d4-760434439420", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "published-proof-of-concept", "source": "Telegram/rQ4TtK-gm_wZkindnxIbfunvDKGD8cezUc1CWrsBkdZGuRc", "content": "", "creation_timestamp": "2026-09-20T18:00:04.328055Z"}, {"uuid": "481ecd97-3cf4-4a51-ad0c-c6b2345bccdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvxszfsuhj2t", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-89274: The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1\nCVSS 9.1 \u00b7 EPSS 0.4%\nhttps://beta.vulnsea.com/cve/CVE-2026-89274\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-20T18:24:33.892476Z"}, {"uuid": "aff53baa-9b14-4c82-b2ee-5d5d4241f754", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102886", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a By-Poloss..-.CVE-2026-89274\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Polosss\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-20 16:56:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated Arbitrary Shortcode Execution\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-20T20:00:04.688355Z"}, {"uuid": "4d2147d5-1639-4aaa-a2b8-a8b4f01d2e61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "Telegram/F-nhc0ijtr3NaromnbizNbgs7TOvAKcStOoCvZVO5zQF_tg", "content": "", "creation_timestamp": "2026-09-22T07:00:06.142528Z"}, {"uuid": "574e29cd-34c4-45ca-ad72-5b382637a159", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "Telegram/aeRqtuX-_28SBE2bLUk7Kgjz-gAg1J_Th2DcSqY86SuOOqM", "content": "", "creation_timestamp": "2026-09-22T07:00:07.035051Z"}, {"uuid": "b9592d5a-be2b-4072-b798-5e610db23c95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "Telegram/BH3x7LFOYQ45thZpGfUbjH9k_Z5-lSceTabyhNzE0tdzuko", "content": "", "creation_timestamp": "2026-09-22T07:00:10.002478Z"}, {"uuid": "3f8d023c-71dc-48db-ac3e-5eefa528b94a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "Telegram/5yYcJ8KxvxPc2wm8yAMZr4IlCi_IPgBAjiTQuvArbIBOcZs", "content": "", "creation_timestamp": "2026-09-22T07:00:07.777542Z"}, {"uuid": "7f7823c2-b8f3-4bde-952c-017163dc3bdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "published-proof-of-concept", "source": "Telegram/BH3x7LFOYQ45thZpGfUbjH9k_Z5-lSceTabyhNzE0tdzuko", "content": "", "creation_timestamp": "2026-09-23T00:00:12.746173Z"}, {"uuid": "b17b037e-29fb-46c2-90a7-2225a08bfe1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "published-proof-of-concept", "source": "Telegram/5yYcJ8KxvxPc2wm8yAMZr4IlCi_IPgBAjiTQuvArbIBOcZs", "content": "", "creation_timestamp": "2026-09-23T00:00:14.516455Z"}, {"uuid": "3b3cb725-0e5e-4bed-906e-9180bb576daa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "published-proof-of-concept", "source": "Telegram/aeRqtuX-_28SBE2bLUk7Kgjz-gAg1J_Th2DcSqY86SuOOqM", "content": "", "creation_timestamp": "2026-09-23T00:00:23.803735Z"}, {"uuid": "384519f8-8fca-4c29-8763-7498fb41ba4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "published-proof-of-concept", "source": "Telegram/F-nhc0ijtr3NaromnbizNbgs7TOvAKcStOoCvZVO5zQF_tg", "content": "", "creation_timestamp": "2026-09-23T00:00:24.966881Z"}, {"uuid": "eb67b828-3c3e-4cfc-b481-118812444d33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117326338762895361", "content": "CVE-2026-89274: WP Recipe Maker plugin RCE via shortcode injection, CVSS 9.1, no patch yet. Update immediately. https://www.valtersit.com/cve/CVE-2026-89274/ #CVE #WordPress #infosec", "creation_timestamp": "2026-09-24T13:51:06.533723Z"}, {"uuid": "4224f9db-f573-4c18-b602-b478fd182c0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwbg4bqz7a22", "content": "CVE-2026-89274: WP Recipe Maker plugin RCE via shortcode injection, CVSS 9.1, no patch yet. Update immediately. https://www.valtersit.com/cve/CVE-2026-89274/ #CVE #WordPress #infosec", "creation_timestamp": "2026-09-24T14:00:11.564996Z"}, {"uuid": "e123b67c-e190-4fc3-98a5-6f68834e2ae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://t.me/GithubRedTeam/103152", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-89274-wp-recipe-maker-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 16:29:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-89274 \u2014 WP Recipe Maker <= 10.8.1 arbitrary shortcode execution via rating-comment reviewBody (CVSS 9.1): Docker validation lab with vulnerable (10.8.1) vs patched (10.8.2) controls, Python PoC proving server-side shortcode execution in recipe JSON-LD, nuclei version screen. Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-23T17:00:08.000000Z"}, {"uuid": "fb1b7e6e-c861-4bc4-a454-6367ec6878bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103152", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-89274-wp-recipe-maker-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 16:29:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-89274 \u2014 WP Recipe Maker <= 10.8.1 arbitrary shortcode execution via rating-comment reviewBody (CVSS 9.1): Docker validation lab with vulnerable (10.8.1) vs patched (10.8.2) controls, Python PoC proving server-side shortcode execution in recipe JSON-LD, nuclei version screen. Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-23T17:00:08.000000Z"}, {"uuid": "e545096e-ef8b-4ca5-b2ac-11f8b18747fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "Telegram/casOb_urBwXkBUZvllR9Y1soseAr2u2g5tENUUxRQxBEAPw", "content": "", "creation_timestamp": "2026-09-24T03:00:06.000000Z"}]}