Executive brief
WP Recipe Maker is a WordPress plugin that creates and displays recipe content. Due to missing capability checks in an AJAX endpoint, any authenticated user—including low-privilege subscribers—can view the full content of draft and private recipes that should be restricted. An attacker with a basic account could discover sensitive recipe data intended only for authorized editors and administrators.
Technical details
The wprm_shortcode_preview AJAX action fails to verify user permissions before returning unpublished recipe content, violating WordPress capability checks. Any authenticated user can exploit this by calling the vulnerable AJAX endpoint directly, bypassing WordPress's standard access controls. The vulnerability affects versions 10.3.0 through 10.8.1 and is resolved in 10.8.2.
Affected products
- Advertising Motive WP Recipe Maker 10.3.0 to 10.8.1
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: Fixed in version 10.8.2