CVE-2025-11755

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11755", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-14T18:26:47.197Z", "datePublished": "2025-11-01T06:40:39.047Z", "dateUpdated": "2026-04-08T16:56:32.757Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:32.757Z"}, "affected": [{"vendor": "wpdelicious", "product": "WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.9.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE)."}], "title": "Delicious Recipes <= 1.9.0 - Authenticated (Contributor+) Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/603210ca-7231-4c91-8258-fe3cd6e37425?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/delicious-recipes/trunk/src/api/inc/endpoints/class-delicious-recipes-rest-import-recipe-terms-controller.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}, {"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "timeline": [{"time": "2025-10-31T18:07:03.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T13:22:11.016816Z", "id": "CVE-2025-11755", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T13:30:34.941Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11755", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-03T13:22:11.016816Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T13:22:11.745Z"}}], "cna": {"title": "Delicious Recipes <= 1.9.0 - Authenticated (Contributor+) Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}, {"lang": "en", "type": "finder", "value": "theviper17"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "wpdelicious", "product": "WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.9.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-31T18:07:03.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/603210ca-7231-4c91-8258-fe3cd6e37425?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/delicious-recipes/trunk/src/api/inc/endpoints/class-delicious-recipes-rest-import-recipe-terms-controller.php"}], "descriptions": [{"lang": "en", "value": "The WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-01T06:40:39.047Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11755", "state": "PUBLISHED", "dateUpdated": "2025-11-03T13:30:34.941Z", "dateReserved": "2025-10-14T18:26:47.197Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-01T06:40:39.047Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes)", "vendor": "wpdelicious", "versions": [{"lessThanOrEqual": "1.9.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Delicious \u2013 Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE)."}, {"lang": "es", "value": "El plugin WP Delicious - Recipe Plugin for Food Bloggers (anteriormente Delicious Recipes) para WordPress es vulnerable a la carga arbitraria de archivos al importar recetas a trav\u00e9s de CSV en todas las versiones hasta la 1.9.0, inclusive. Esta vulnerabilidad permite a un atacante con permisos de al menos nivel Colaborador subir un archivo PHP malicioso proporcionando una URL remota durante un proceso de importaci\u00f3n de recetas, lo que lleva a la ejecuci\u00f3n remota de c\u00f3digo (RCE)."}], "id": "CVE-2025-11755", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11755", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T13:22:11.016816Z", "version": "2.0.3"}}]}, "published": "2025-11-01T07:15:35.130", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/delicious-recipes/trunk/src/api/inc/endpoints/class-delicious-recipes-rest-import-recipe-terms-controller.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/603210ca-7231-4c91-8258-fe3cd6e37425?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:34:03.806942+00:00", "value": {"mitigation_remediation": ["Update the WP Delicious plugin to a version newer than 1.9.0, which removes the insecure import path.", "If an update is not immediately possible, limit Contributor-level access or protect the import endpoint by using a capability check that blocks file uploads.", "Enforce stricter file type validation by allowing only the CSV extension and checking MIME types, and monitor the upload directory for unexpected PHP files."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All versions of WP Delicious \u2013 Recipe Plugin for Food Bloggers up to and including 1.9.0 are affected. The plugin is a WordPress plugin used by food bloggers to import recipes using CSV files. WordPress installations that include this plugin with Contributor or higher roles are vulnerable.", "description_and_impact": "This flaw permits an attacker with Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import via CSV, enabling remote code execution. The vulnerability stems from inadequate file type validation (CWE-434) and allows execution of arbitrary code on the host server. The impact results in full compromise of the affected site if the attacker succeeds.", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1\u202f% suggests a low probability of exploitation at this moment, though the lack of known exploitation may reflect limited demand or detection. The flaw is not currently listed in the CISA KEV catalog. An attacker must authenticate as a Contributor or higher to use the import feature, so the attack path requires legitimate access; however, once authenticated the exploit path is straightforward: upload a sanitized PHP file to be placed in the upload directory and trigger its execution via a crafted request or by accessing the file directly."}}}}, "created": "2025-11-03T10:43:35.644190+00:00", "updated": "2026-04-22T12:45:17.021313+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpdelicious", "wpdelicious$PRODUCT$wp_delicious", "wpdelicious$PRODUCT$wpdelicious"]}