Executive brief
WP Delicious, a WordPress plugin used for managing and displaying recipes, contains a security flaw that allows anyone to modify certain data on a website without logging in. Specifically, an attacker can artificially inflate the 'like' count on any post or page and repeatedly add data to the site's database. While this does not expose private user information, it can be used to manipulate site metrics or potentially degrade website performance by bloating the database with junk data.
Technical details
The vulnerability is an authorization bypass within the 'recipe_likes' AJAX action of the WP Delicious plugin. The plugin fails to validate the identity or permissions of the requester, allowing unauthenticated network-based attackers to trigger the action. By sending crafted POST requests to wp-admin/admin-ajax.php, an attacker can modify the '_recipe_likes' counter and the '_recipe_likes_ip' identifier list for any post ID. This can lead to data inflation where the serialized metadata array grows without bound, potentially causing performance issues or storage exhaustion. The issue is fixed in version 1.10.2.
Affected products
- WP Delicious WP Delicious (formerly Delicious Recipes) < 1.10.2
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-30: advisory: NVD published date
- 2026-07-30: patched: Fixed in version 1.10.2