What the vulnerability does
01Description
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). This can also lead to the reading of arbitrary files that may contain sensitive information like wp-config.php.
Explanation of Vulnerability in Simple Terms
02Summary
WP Delicious Recipe Plugin versions up to 1.6.9 contain an external input validation flaw that allows authenticated users to read and modify sensitive data. An attacker with a low-privilege account can access or alter information they should not have permission to view or change. The vulnerability requires an active user account but no additional user interaction.
What an attacker can do
03Attacker Capabilities
Read and modify sensitive data in the plugin without proper authorization.
Potential impact on your site
04Site Impact
Any registered user can access and alter recipe data and plugin settings they shouldn't have permission to modify.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the WordPress site.
Key dates
06Disclosure timeline
September 11, 2024
CVE published
April 8, 2026
Record updated
