CVE-2025-11755 Delicious Recipes <= 1.9.0 - Authenticated (Contributor+) Arbitrary File Upload
Authenticated contributors can upload malicious PHP files via CSV import, leading to remote code execution on WordPress sites.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-11755?
CVE-2025-11755 is a high-severity vulnerability in wpdelicious WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes), published on 1 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE).
Weakness: CWE-434
Which versions are affected by CVE-2025-11755?
How do I fix CVE-2025-11755?
No fix has been published for CVE-2025-11755 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-11755 being exploited?
There is no known exploitation of CVE-2025-11755 in the wild and no public exploit code.
Sources
Also known as GHSA-qpfm-wcw2-8hxv.