CVE-2025-11755: Delicious Recipes <= 1.9.0 - Authenticated (Contributor+) Arbitrary File Upload
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11755?
CVE-2025-11755 has a high severity due to its potential for arbitrary file uploads, which can lead to full system compromise.
How do I fix CVE-2025-11755?
To fix CVE-2025-11755, update the WP Delicious Recipe Plugin for Food Bloggers to version 1.9.1 or later.
Who is affected by CVE-2025-11755?
All users of the WP Delicious Recipe Plugin for Food Bloggers up to and including version 1.9.0 are affected by CVE-2025-11755.
Can CVE-2025-11755 be exploited by unauthenticated users?
No, CVE-2025-11755 requires the attacker to have at least Contributor-level permissions to exploit the vulnerability.
What actions can an attacker take if CVE-2025-11755 is exploited?
If exploited, an attacker can upload arbitrary files which could lead to remote code execution or unauthorized access to the server.