CVE-2025-11755

{
  "id": "CVE-2025-11755",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-01T07:15:35.130",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE)."
    },
    {
      "lang": "es",
      "value": "El plugin WP Delicious - Recipe Plugin for Food Bloggers (anteriormente Delicious Recipes) para WordPress es vulnerable a la carga arbitraria de archivos al importar recetas a través de CSV en todas las versiones hasta la 1.9.0, inclusive. Esta vulnerabilidad permite a un atacante con permisos de al menos nivel Colaborador subir un archivo PHP malicioso proporcionando una URL remota durante un proceso de importación de recetas, lo que lleva a la ejecución remota de código (RCE)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "wpdelicious",
          "product": "WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.9.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-03T13:22:11.016816Z",
          "id": "CVE-2025-11755",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://plugins.trac.wordpress.org/browser/delicious-recipes/trunk/src/api/inc/endpoints/class-delicious-recipes-rest-import-recipe-terms-controller.php",
      "source": "[email protected]"
    },
    {
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/603210ca-7231-4c91-8258-fe3cd6e37425?source=cve",
      "source": "[email protected]"
    }
  ]
}