What the vulnerability does
01Description
The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the api_get_post_summary function due to insufficient restrictions on which posts can be retrieved. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from posts they may not be able to edit or read otherwise. This also affects password protected, private, or draft posts that they should not have access to.
Explanation of Vulnerability in Simple Terms
02Summary
WP Recipe Maker versions up to 10.2.2 expose sensitive information to authenticated users. A logged-in user with low privileges can read data they should not have access to. The vulnerability requires a valid WordPress account but no special interaction. Update to a version newer than 10.2.2 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read sensitive information accessible only to higher-privilege users.
Potential impact on your site
04Site Impact
Authenticated users can access private recipe data or settings not intended for their role.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with low privileges.
Key dates
06Disclosure timeline
January 16, 2026
CVE published
April 14, 2026
Record updated
