Cyber Posture

CVE-2025-11755

High

Published: 01 November 2025

Published
01 November 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0019 40.4th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

Security Summary

CVE-2025-11755 is an arbitrary file upload vulnerability in the WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress, affecting all versions up to and including 1.9.0. The flaw occurs during CSV-based recipe imports, where the plugin fails to properly validate files fetched from remote URLs, allowing malicious PHP files to be uploaded. Published on 2025-11-01, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).

Attackers with at least Contributor-level permissions can exploit this vulnerability by supplying a remote URL pointing to a malicious PHP file during the recipe import process via the plugin's REST API endpoint. Successful exploitation leads to remote code execution (RCE) on the targeted WordPress site, potentially granting full server compromise depending on the uploaded payload and server configuration.

Advisories, including Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/603210ca-7231-4c91-8258-fe3cd6e37425?source=cve, provide further details on the issue. The vulnerable code in the REST import controller is visible in the WordPress plugin trac at https://plugins.trac.wordpress.org/browser/delicious-recipes/trunk/src/api/inc/endpoints/class-delicious-recipes-rest-import-recipe-terms-controller.php.

Details

CWE(s)
CWE-434

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

The vulnerability enables exploitation of a public-facing WordPress plugin (T1190), allows low-privileged users (Contributor) to achieve RCE implying privilege escalation (T1068), and facilitates uploading PHP web shells (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References