WP Recipe Maker, CVE-2026-75905

CVE, Research URL: CVE-2026-75905
Home page URL: Security reports for WP Recipe Maker
Application: WP Recipe Maker
Published on: Sep 09, 2026
Research Description: The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to take ownership of any admin-authored recipe by rewriting its post_author to the attacker's user ID, and unpublish it by overwriting its post_status with the contributor's draft or pending post status. This requires the default 'recipe_use_author' setting to be set to 'parent' for the ownership transfer to occur, though unpublishing remains possible regardless of this setting.
Affected versions: max 10.8.1.
Status: vulnerable