Description
The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Recipe Maker | 10.3.0 – < 10.8.2 | 10.8.2 |
References
- https://wpscan.com/vulnerability/46324e95-20dc-465e-90ab-14bcbf136166/ exploit vdb-entry technical-description