PT-2026-3217 · WordPress · Wp Recipe Maker

Dmitry Ignatyev · Published 2026-01-16 · Updated 2026-01-16 · CVE-2025-15527

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions up to and including 10.2.2

Description The WP Recipe Maker plugin for WordPress has an information exposure issue. Insufficient restrictions on post retrieval within the api get post summary function allow authenticated attackers with Contributor-level access or higher to extract data from posts they should not be able to access. This includes password-protected, private, or draft posts.

Recommendations Update WP Recipe Maker to a version later than 10.2.2.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-15527

Affected Products

Wp Recipe Maker

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-15527 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php#L172 · Note
• https://research.cleantalk.org/cve-2025-15527 · Note
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php#L86 · Note
• https://twitter.com/VulmonFeeds/status/2012115034910986706 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3415263/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php?contextall=1&old=3402554&old_path=%2Fwp-recipe-maker%2Ftrunk%2Fincludes%2Fpublic%2Fapi%2Fclass-wprm-api-utilities.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/96f77fdc-4e91-43c0-8bc6-7bb202945c7d?source=cve · Note
• https://twitter.com/CVEnew/status/2012126453802922307 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php#L48 · Note