PT-2026-22295 · Unknown · Wp Recipe Maker

Quốc Huy · Publicado 2026-02-27 · Atualizado 2026-02-27 · CVE-2026-1558

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.3.3

Description The software is susceptible to an Insecure Direct Object Reference (IDOR) issue. The /wp-json/wp-recipe-maker/v1/integrations/instacart API endpoint has a permission check set to always return true, and lacks authorization checks on the recipeId parameter provided by the user. This allows unauthenticated attackers to modify arbitrary post metadata (wprm instacart combinations) using the recipeId parameter.

Recommendations Update WP Recipe Maker to version 10.3.3 or later.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-1558

Produtos afetados

Wp Recipe Maker

Referências · 8

• https://t.me/cveNotify/153421 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/90a5589f-f0e9-4511-9c5e-0afcee0824d5?source=cve · Nota
• https://t.me/CVEtracker/45936 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2027380198488842419 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-1558 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464195%40wp-recipe-maker%2Ftrunk&old=3441130%40wp-recipe-maker%2Ftrunk&sfp_email=&sfph_mail= · Nota
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.3.2/includes/public/class-wprm-instacart.php#L110 · Nota
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.3.2/includes/public/api/class-wprm-api-integrations.php#L40 · Nota