# Recipe Maker <= 10.8.5 - Unauthenticated Sensitive Information Exposure via Private and Trashed Recipes

- **ID:** WPSEC-2026-0904
- **Plugin:** WP Recipe Maker (`wp-recipe-maker`), https://wordpress.org/plugins/wp-recipe-maker/
- **Affected versions:** from 10.8.4 before 10.9.0
- **Fixed in:** 10.9.0 (Update to 10.9.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-284
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-recipe-maker
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0904/

## Description

The WP Recipe Maker plugin for WordPress is vulnerable to Sensitive Information Exposure via the recipe print page in versions 10.8.4 through 10.8.5, due to the recipe access check in WPRM_Recipe_Manager::get_recipe() allowing any non-public recipe to load whenever its stored parent post is public, without excluding recipes that were deliberately set to private or moved to the trash. This makes it possible for unauthenticated attackers to view the full contents of private or trashed recipes that still reference a published parent post.

## References

- https://wpsec.com/vuln/WPSEC-2026-0904/
- https://plugins.svn.wordpress.org/wp-recipe-maker/tags/10.9.0/
- https://wordpress.org/plugins/wp-recipe-maker/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0904/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.