{
 "id": "WPSEC-2026-0904",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0904/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0904/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0904/index.md",
 "title": "Recipe Maker <= 10.8.5 - Unauthenticated Sensitive Information Exposure via Private and Trashed Recipes",
 "description": "The WP Recipe Maker plugin for WordPress is vulnerable to Sensitive Information Exposure via the recipe print page in versions 10.8.4 through 10.8.5, due to the recipe access check in WPRM_Recipe_Manager::get_recipe() allowing any non-public recipe to load whenever its stored parent post is public, without excluding recipes that were deliberately set to private or moved to the trash. This makes it possible for unauthenticated attackers to view the full contents of private or trashed recipes that still reference a published parent post.",
 "plugin": {
  "slug": "wp-recipe-maker",
  "name": "Recipe Maker",
  "full_name": "WP Recipe Maker",
  "wordpress_org": "https://wordpress.org/plugins/wp-recipe-maker/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-recipe-maker/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-recipe-maker"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-284"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "10.8.4",
    "from_inclusive": true,
    "to": "10.9.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 10.8.4 before 10.9.0"
  ]
 },
 "introduced_in": "10.8.4",
 "fixed_in": "10.9.0",
 "remediation": "Update to 10.9.0 or later.",
 "fix_released": "2026-10-13T12:50:33+00:00",
 "published": "2026-10-14T12:52:26+00:00",
 "updated": "2026-10-14T12:18:19.502526+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0904/",
  "https://plugins.svn.wordpress.org/wp-recipe-maker/tags/10.9.0/",
  "https://wordpress.org/plugins/wp-recipe-maker/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-recipe-maker",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-14"
 }
}