Beveiligingsadvies

CVE-2026-1558

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-02-27 04:33:03

Laatst bijgewerkt 2026-04-08 17:06:48

Toegewezen door Wordfence

CVSS-score 5.3

Status PUBLISHED

Beschrijving

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permission_callback being set to __return_true and a lack of subsequent authorization or ownership checks on the user-supplied recipeId. This makes it possible for unauthenticated attackers to overwrite arbitrary post metadata (wprm_instacart_combinations) for any post ID on the site via the recipeId parameter.

← Alle CVE's bekijken Bekijk op cve.org ↗