Description

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-23T06:17:04.030Z",
  "pubdate": "2026-09-23T06:17:04.030Z",
  "executiveSummary": "The WP Recipe Maker WordPress plugin prior to version 10.8.2 is susceptible to an unauthenticated metadata injection vulnerability. This flaw stems from a critical lack of authorization checks and input validation within a specific REST API route. By interacting with this exposed endpoint, an unauthenticated remote attacker can inject arbitrary and excessive data into the user_meta table of any registered user, including administrators.\nThe primary impact of this vulnerability is a permanent denial-of-service (DoS) condition at the user account level. By corrupting the user metadata, an attacker can trigger fatal errors or application logic failures that prevent the affected user from loading their profile or accessing the WordPress dashboard. Because the vulnerability does not enforce constraints on the data stored, an attacker can manipulate account configurations, effectively locking out privileged accounts. This is a high-severity issue that compromises site availability and administrative integrity, requiring immediate remediation through software updates.",
  "technicalDetails": "The vulnerability resides within the REST API implementation of the WP Recipe Maker plugin. The root cause is the absence of proper nonce verification or permission checks on a REST route designed to handle user metadata operations. REST API routes in WordPress are typically registered via the 'rest_api_init' hook; if the 'permission_callback' argument is missing or improperly configured, the endpoint becomes accessible to any user, including unauthenticated visitors.\nThe exploitation mechanism involves sending a crafted HTTP POST request to the vulnerable endpoint. Because the plugin fails to perform server-side authorization checks, the application processes the request without validating whether the sender has the authority to modify metadata for the target user ID. Furthermore, the absence of input validation or length constraints allows an attacker to inject large, malformed, or malicious payloads directly into the WordPress database's 'wp_usermeta' table.\nThe attack flow follows these steps: 1) The attacker identifies the vulnerable REST API endpoint associated with WP Recipe Maker. 2) The attacker constructs a malicious payload containing arbitrary key-value pairs designed to conflict with WordPress user initialization processes. 3) The attacker submits this payload via an unauthenticated REST request targeting a specific user ID (e.g., an administrator ID). 4) The plugin backend executes the metadata update function without verifying identity. 5) The application writes the payload into the database. 6) Upon the target user's next login or session attempt, the application attempts to load the corrupted metadata, resulting in an unrecoverable state or application crash.\nThe impact is significant because the stored data is persistent. By injecting specific metadata that the application logic expects to be of a certain format or size, the attacker can cause PHP execution errors or memory exhaustion whenever the compromised account is processed. This effectively denies the user access to the dashboard or account settings. Since the exploit does not require active session cookies or elevated privileges, it poses a direct risk to any WordPress instance utilizing the affected plugin version. The exposure is limited only by the attacker's ability to discover the vulnerable endpoint and the target's user ID, which is often discoverable through standard WordPress enumeration techniques."
}