CVE-2024-7626: 
WordPress vulnerability analysis and mitigation

The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) WordPress plugin contains a vulnerability (CVE-2024-7626) affecting all versions up to and including 1.6.9. The vulnerability stems from insufficient file path validation in the saveeditprofile_details() function (NVD).

The vulnerability is characterized by insufficient file path validation that enables arbitrary file movement and reading capabilities. The issue has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. The vulnerability is classified under CWE-73 (External Control of File Name or Path) (NVD, Wordfence).

The vulnerability allows authenticated attackers with subscriber-level access or higher to move arbitrary files on the server and read sensitive files. This can lead to remote code execution when critical files like wp-config.php are moved, and potential exposure of sensitive information through unauthorized file access (NVD).

Users should update to version 1.7.0 or later of the WP Delicious plugin which contains the security fix. A patch has been implemented and is available through the WordPress plugin repository (Wordfence).