PT-2026-21892 · WordPress · Wp Recipe Maker

Abhinav Jaswal · Published 2026-02-25 · Updated 2026-02-25 · CVE-2025-14742

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.2.3

Description The WP Recipe Maker plugin for WordPress has a flaw that allows unauthorized access to recipe data. This is due to a missing capability check in the ajax search recipes and ajax get recipe functions. Attackers with Subscriber-level access or higher can retrieve sensitive recipe information, including drafts, pending recipes, and private recipes that they are not authorized to view.

Recommendations Update WP Recipe Maker to version 10.2.3 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-14742

Affected Products

Wp Recipe Maker

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-14742 · Security Note
• https://t.me/CVEtracker/45718 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-manager.php#L161 · Note
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-manager.php#L46 · Note
• https://t.me/cveNotify/153131 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026637654054310189 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3440361/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-manager.php · Note
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-manager.php#L301 · Note
• https://twitter.com/CVEnew/status/2026641316847722946 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/10c17e74-dced-483e-bcaf-00ff5b11059c?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-manager.php#L47 · Note