We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

WordPress Security Bulletin: WP Recipe Maker Plugin Vulnerability (CVE-2025-14742)

Nick Paliughi
On this page

Security Alert Summary

The WP Recipe Maker plugin for WordPress contains a missing capability check in two public AJAX functions, allowing authenticated users with Subscriber-level access and above to retrieve recipe content they should not be able to access. This can expose draft, pending, and private recipes to low-privileged authenticated users.

CVE Details

  • CVE ID: CVE-2025-14742
  • Affected plugin / component: WP Recipe Maker plugin — missing capability check on the ajax_search_recipes and ajax_get_recipe functions
  • Affected versions: All versions up to and including 10.2.3
  • Published: February 25, 2026 at 10:16:18 AM
  • Last modified: February 25, 2026 at 2:15:29 PM
  • CVSS v3.1 base score / severity / vector: 4.3 / MEDIUM / CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • Authentication / privileges / user interaction: Authenticated attacker required; privileges equivalent to Subscriber-level (low privileges). No user interaction required.
  • Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
  • CWE / weakness: CWE-639 (as listed in the CVE entry)

Technical Details

The vulnerability is a missing capability check in the plugin’s public AJAX handlers. Specifically, the ajax_search_recipes and ajax_get_recipe functions lack proper capability/permission validation, which allows authenticated users with Subscriber-level access and above to request and receive recipe data they should not be permitted to see. The CVE description notes this affects all versions up to and including 10.2.3.

Because the functions are exposed via AJAX, a low-privileged authenticated user can call the endpoints and obtain recipe content including drafts, pending posts, and private recipes. The weakness is categorized as CWE-639 — which covers authorization issues due to missing required checks.

How This Could Impact Your Website

In a typical small business WordPress site, you might have a site owner, a couple of internal content editors, and external contributors or contractors with Subscriber or Contributor accounts. With this vulnerability, a user who only has Subscriber-level access could access unpublished or private recipe content submitted by editors or contractors. Practical consequences include disclosure of unpublished content, drafts containing internal notes, or recipe details intended for private review, which could increase the risk of targeted social engineering or follow-up reconnaissance.

This issue does not indicate direct modification of content (integrity) or site downtime (availability) based on the CVSS impacts, but it does represent a confidentiality exposure for recipe content. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially contributor and subscriber accounts that do not require access.
  • Enforce strong passwords and two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins from your site.
  • Monitor site activity and logs for unusual access to AJAX endpoints or unexpected requests for recipe content.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
WordPress Security Bulletin: WPGSI: Spreadsheet Integration (CVE-2026-1916)
Next Post
WordPress Security Bulletin: Secure Copy Content Protection and Content Locking Plugin (CVE-2026-2367)