Vulnerabilities / Recipe Maker / WPSEC-2026-0904
Recipe Maker <= 10.8.5 - Unauthenticated Sensitive Information Exposure via Private and Trashed Recipes
Medium 5.3
CWE-284Fixed in 10.9.0
- ID
- WPSEC-2026-0904
- Plugin
- WP Recipe Maker (wp-recipe-maker)
- Affected
- from 10.8.4 before 10.9.0
- Remediation
- Update to 10.9.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-284
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- Recipe Maker on WPSec AttackSurface
- Fix released
- Published
Description
The WP Recipe Maker plugin for WordPress is vulnerable to Sensitive Information Exposure via the recipe print page in versions 10.8.4 through 10.8.5, due to the recipe access check in WPRM_Recipe_Manager::get_recipe() allowing any non-public recipe to load whenever its stored parent post is public, without excluding recipes that were deliberately set to private or moved to the trash. This makes it possible for unauthenticated attackers to view the full contents of private or trashed recipes that still reference a published parent post.
References
- https://wpsec.com/vuln/WPSEC-2026-0904/
- https://plugins.svn.wordpress.org/wp-recipe-maker/tags/10.9.0/
- https://wordpress.org/plugins/wp-recipe-maker/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS