CVE-2025-11755
Delicious Recipes <= 1.9.0 - Authenticated (Contributor+) Arbitrary File Upload
highUnrestricted Upload of File with Dangerous Type
8.8
CVSS Score
8.8
CVSS Score
high
Severity
1.9.1
Patched in
1d
Time to patch
Description
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE).
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAttack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
High
Confidentiality
High
Integrity
High
Availability
Technical Details
Affected versions
<=1.9.0PublishedOctober 31, 2025
Last updatedNovember 1, 2025
Affected plugindelicious-recipes
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.