---
id: CVE-2026-75905
title: >-
  The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass
  in all versions up to, and including, 10.8.0
summary: >-
  The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass
  in all versions up to, and including, 10.8.0. This is due to the plugin not
  properly verifying that a user is authorized to perform an action. This makes
  it p…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-862
vendor: brechtvds
product: WP Recipe Maker
affected:
  - wp_recipe_maker <= 10.8.0
published: '2026-09-09'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:17:05.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75905'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.8.0/includes/public/class-wprm-recipe-saver.php#L572
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.8.0/includes/public/class-wprm-recipe-saver.php#L630
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.8.0/includes/public/class-wprm-recipe-saver.php#L729
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3677870%40wp-recipe-maker&new=3677870%40wp-recipe-maker
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/eee25825-2308-4234-b72b-6cb11b658a6e?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-09T15:03:03.620600Z'
epss: 0.00366
epssPercentile: 0.27833
ingestedAt: '2026-09-09T06:01:00.000Z'
---

## Overview

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to take ownership of any admin-authored recipe by rewriting its post_author to the attacker's user ID, and unpublish it by overwriting its post_status with the contributor's draft or pending post status. This requires the default 'recipe_use_author' setting to be set to 'parent' for the ownership transfer to occur, though unpublishing remains possible regardless of this setting.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.