MeldSecurity
Press Enter to search
CVE Database & Search →
Sign In Get Started

CVE-2026-1558

🟡 MEDIUM

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integratio...

Published
Feb 27, 2026
Last Modified
Feb 27, 2026
Views
11
Bookmarks
0

Description

Request Expert Review

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permission_callback being set to __return_true and a lack of subsequent authorization or ownership checks on the user-supplied recipeId. This makes it possible for unauthenticated attackers to overwrite arbitrary post metadata (wprm_instacart_combinations) for any post ID on the site via the recipeId parameter.

CVSS Scores

CVSS 3.1 5.3
5.3
MEDIUM
CVSS 2.0 5.3

References

plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org www.wordfence.com

Additional Information

Source
security@wordfence.com
State
Received

Related CVEs

CVE-2026-3292

MEDIUM

A security vulnerability has been detected in jizhiCMS up to 2.5.6. Affected is the function findAll in the library frphp/lib/Model.php of the compone...

Score: 6.3

CVE-2026-3289

MEDIUM

A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the...

Score: 6.3

CVE-2026-3287

MEDIUM

A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/ma...

Score: 6.3

CVE-2026-28370

CRITICAL

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code executio...

Score: 9.1

CVE-2026-1442

HIGH

Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying atte...

Score: 7.8

CVE-2026-3286

MEDIUM

A vulnerability was identified in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3. The impacted element is the function Save of the file paicoding-web/src/...

Score: 6.3

Share CVE-2026-1558

Share on Social Media

Copy Link

Embed Code

Request Expert Analysis

Request a professional security analysis for CVE-2026-1558 from our verified experts.

Credits System

Use your credits to get expert analysis from verified security professionals. Purchase more credits anytime!

Add 3 credits for accelerated delivery

Base Cost: 8 credits
Priority Upgrade: + credits
SLA Acceleration: +3 credits
Total Cost:
Your Balance:

Insufficient Credits

You need more credits to submit this request.

Buy Credits

Report Analysis