SQL Injection Vulnerability in WP Recipe Maker Plugin

CVE-2024-1206

Summary

The WP Recipe Maker plugin for WordPress is affected by a SQL Injection vulnerability that occurs when the 'recipes' parameter is processed. The vulnerability is due to inadequate escaping of user-supplied input and insufficient preparation of the SQL query structure. As a result, authenticated attackers with subscriber-level access or higher can inject additional SQL commands into existing queries. This exploitation potentially enables malicious users to extract sensitive data from the underlying database, posing serious risks to user privacy and website integrity.

References