PT-2026-3217 · WordPress · Wp Recipe Maker

Dmitry Ignatyev · CVE-2025-15527 · Publicado 2026-01-16 · Atualizado 2026-01-16

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions up to and including 10.2.2

Description The WP Recipe Maker plugin for WordPress has an information exposure issue. Insufficient restrictions on post retrieval within the api get post summary function allow authenticated attackers with Contributor-level access or higher to extract data from posts they should not be able to access. This includes password-protected, private, or draft posts.

Recommendations Update WP Recipe Maker to a version later than 10.2.2.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2025-15527

Produtos afetados

Wp Recipe Maker

Referências · 9

• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php#L172 · Nota
• https://research.cleantalk.org/cve-2025-15527 · Nota
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php#L86 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-15527 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2012115034910986706 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3415263/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php?contextall=1&old=3402554&old_path=%2Fwp-recipe-maker%2Ftrunk%2Fincludes%2Fpublic%2Fapi%2Fclass-wprm-api-utilities.php · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/96f77fdc-4e91-43c0-8bc6-7bb202945c7d?source=cve · Nota
• https://twitter.com/CVEnew/status/2012126453802922307 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php#L48 · Nota