Executive brief
The Cooked WordPress plugin, used to create and manage recipes and food content, contains an access control flaw that allows authenticated contributors to view or access data belonging to other users by modifying IDs in URLs. An attacker with a contributor-level account could exploit this to expose private recipe data, user information, or other restricted content without additional authentication.
Technical details
This is an Insecure Direct Object Reference (IDOR) vulnerability in the Cooked WordPress plugin versions up to 1.16.0. The vulnerability exists in a component that fails to properly validate object ownership before returning data, allowing an attacker with contributor privileges to enumerate and access resources belonging to other users by manipulating object IDs in API calls or request parameters. The attack requires an authenticated contributor-level account to exploit. The vulnerability is classified under OWASP A1 (Broken Access Control). A patch is available in version 1.16.1 and later.
Affected products
- Gora Tech Cooked ≤1.16.0
Timeline
- 2026-09-04: disclosed: Reported to Patchstack
- 2026-09-16: advisory: Published by Patchstack; early warning issued to customers
- 2026-09-16: patched: Fix available in version 1.16.1