CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WP Recipe Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_search_recipes' and 'ajax_get_recipe' functions in all versions up to, and including, 10.2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive recipe information including draft, pending, and private recipes that they shouldn't be able to access.
Explanation of Vulnerability in Simple Terms
WP Recipe Maker versions up to 10.2.3 contain an authorization flaw that allows authenticated users to read sensitive data they should not access. The vulnerability requires a valid WordPress account but no special privileges. An attacker with low-level access can view confidential information through the plugin's functionality.
What an attacker can do
Read sensitive data accessible through the plugin that should be restricted from their user role.
Potential impact on your site
Authenticated users can access confidential recipe or plugin data beyond their intended permission level.
Conditions required to exploit
Attacker must have a valid WordPress user account with at least low-level privileges.
Key dates
External resources
Related vulnerabilities
