CVE-2025-11755 is a vulnerability in the WP Delicious – Recipe Plugin for Food Bloggers WordPress plugin that allows an attacker with at least Contributor-level permissions to upload arbitrary files, including malicious PHP scripts, during the import of recipes via CSV files. This occurs because the plugin does not properly restrict or validate file types during the import process, enabling Remote Code Execution on affected installations. The vulnerability affects all versions up to and including 1.9.0. The CVSS v3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an attacker with Contributor-level access to upload and execute arbitrary PHP code on the server hosting the WordPress site, leading to full Remote Code Execution. This can compromise the confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the critical nature of this impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level permissions carefully and avoid importing recipes from untrusted sources. Monitor for updates from the wpdelicious project regarding patches or official mitigations.