Description

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-23T06:17:03.930Z",
  "pubdate": "2026-09-23T06:17:03.930Z",
  "executiveSummary": "The WP Recipe Maker WordPress plugin prior to version 10.8.2 is susceptible to an improper authorization vulnerability. This security flaw resides within one of the plugin's AJAX action handlers, which fails to implement necessary access control checks.\nThe vulnerability allows any authenticated user—regardless of their assigned role, such as a subscriber—to interact with server-side functions meant for restricted administrative or user-specific operations. By exploiting this oversight, an attacker can retrieve sensitive information, specifically the IDs and titles associated with unpublished lists belonging to other users.\nThe risk implication centers on unauthorized information disclosure, potentially exposing internal content structures or user-generated data that was intended to remain private. The attack requires authenticated access, which poses a significant threat in multi-user WordPress environments where user registration is enabled. No specific elevated privileges are required for exploitation, as the vulnerable AJAX endpoint does not validate the requester's identity against the requested data object.",
  "technicalDetails": "The root cause of this vulnerability is an inadequate implementation of authorization checks within the AJAX action processing logic of the WP Recipe Maker plugin. In the WordPress architecture, AJAX actions are typically handled via the 'wp_ajax_' hook. If a developer fails to perform a capability check—such as utilizing 'current_user_can()' or verifying nonces within the hooked function—the endpoint becomes accessible to any user currently authenticated within the application session.\nThe vulnerable component involves an AJAX endpoint responsible for fetching user-related recipe list data. When this endpoint is invoked, the underlying controller function fails to verify whether the authenticated user possesses the appropriate permissions to view the requested data or if the user is authorized to access unpublished content objects. Consequently, the backend application processes the request, performs a database query, and returns the requested data (IDs and titles of unpublished lists) directly to the client-side.\nThe exploitation flow is straightforward: 1) The attacker authenticates as a low-privileged user (e.g., subscriber). 2) The attacker crafts an HTTP POST request to the 'wp-admin/admin-ajax.php' endpoint, specifying the vulnerable action parameter associated with the recipe list retrieval function. 3) Because the server-side code lacks an 'is_user_logged_in()' or capability validation check, it proceeds to execute the query. 4) The application returns a JSON response containing the sensitive IDs and titles of unpublished lists belonging to other users.\nThis vulnerability highlights a lack of 'Broken Access Control' (CWE-285/CWE-862) mitigations. The impact is primarily categorized as an Improper Authorization vulnerability, leading to the disclosure of sensitive information. The exposure of internal IDs and list titles can facilitate further reconnaissance against the site, potentially leading to additional security complications if those IDs are required for subsequent unauthorized operations, such as modifying, deleting, or publishing content that the user should not have access to.\nThe affected versions include all releases of WP Recipe Maker prior to 10.8.2. Since the vulnerability is strictly a server-side logical error in access control, it does not require any specific network-level manipulation or complex payload injection; it is purely a function of the application's failure to enforce standard security boundaries."
}