Unauthorized Data Access in WP Recipe Maker Plugin by WordPress

CVE-2025-14742

What is CVE-2025-14742?

The WP Recipe Maker plugin for WordPress is susceptible to unauthorized data access due to the absence of a capability check in the 'ajax_search_recipes' and 'ajax_get_recipe' functions. This flaw affects all versions up to and including 10.2.3. As a result, attackers with Subscriber-level access and above may exploit this vulnerability to access confidential recipe data, including drafts, pending items, and private recipes that should remain restricted. Ensuring that capability checks are correctly implemented is vital for the protection of sensitive information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References