Description

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-23T06:17:03.820Z",
  "pubdate": "2026-09-23T06:17:03.820Z",
  "executiveSummary": "The WP Recipe Maker plugin for WordPress, in versions prior to 10.8.2, contains an authorization bypass vulnerability within its AJAX action handling mechanisms.\nThis vulnerability is classified as an Improper Authorization flaw, allowing authenticated users with low privileges, such as subscribers, to access sensitive data.\nThe flaw stems from a lack of server-side capability checks when executing specific AJAX requests, effectively circumventing WordPress access control logic.\nAn attacker can exploit this condition to retrieve the full content of unpublished, private, or draft recipes, leading to unauthorized information disclosure.\nThe risk is categorized as significant because it allows non-administrative users to gain access to potentially proprietary, sensitive, or pre-publication content stored within the database.\nExploitation requires the attacker to possess a valid, authenticated user session within the WordPress environment, which is a common requirement for many WordPress installations allowing user registration.\nNo specific elevated privileges are required for the exploit, as the system fails to validate the user's role before processing the request.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of WordPress AJAX handlers within the WP Recipe Maker plugin. Specifically, the plugin defines an AJAX action that fails to invoke the essential current_user_can() function or similar capability validation checks before executing the requested data retrieval operation.\nIn the WordPress architecture, AJAX actions intended for administrative or restricted content must verify that the user session is associated with appropriate roles—such as 'administrator' or 'editor'—before performing database queries. The WP Recipe Maker plugin, in versions prior to 10.8.2, fails to enforce this check, assuming that the request source is trusted.\nThe exploitation flow proceeds as follows: First, an authenticated user (such as a subscriber) identifies the specific AJAX action endpoint utilized by the plugin. By crafting a POST request to the 'wp-admin/admin-ajax.php' endpoint with the vulnerable action parameter, the user can supply the necessary parameters, such as the post ID of a draft or unpublished recipe.\nUpon receiving this request, the server-side code triggers the associated function. Because there is no logic to verify the user's capability to view private or unpublished posts, the backend proceeds to fetch the requested post object directly from the database.\nThe plugin subsequently returns the serialized or rendered content of the unpublished recipe back to the user's browser, essentially bypassing the standard WordPress post-status visibility restrictions (e.g., 'private' or 'draft' statuses).\nThis vulnerability allows an attacker to programmatically iterate through post IDs to perform reconnaissance or mass extraction of unpublished content. The post-exploitation impact includes the loss of confidentiality regarding unpublished business data, draft content, and sensitive recipe details that were intended to be restricted to editorial staff. Furthermore, since the request is processed through standard AJAX channels, the activity may appear as legitimate traffic in application-level logs, complicating detection unless specific monitoring for unauthorized AJAX access patterns is implemented."
}