WordPress Plugin Vulnerabilities

WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe Disclosure

Description

The plugin does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.

Proof of Concept

Affects Plugins

Fixed in 10.9.2

References

Classification

Type
SENSITIVE DATA DISCLOSURE
CWE

Miscellaneous

Original Researcher
wellknown.info
Submitter
wellknown.info
Submitter website
Submitter twitter
Verified
Yes

Timeline

Publicly Published
2026-11-05 (about 3 days ago)
Added
2026-11-05 (about 2 days ago)
Last Updated
2026-11-05 (about 2 days ago)

Other