CVE-2025-15527: 
WordPress vulnerability analysis and mitigation

CVE-2025-15527 is an Information Exposure vulnerability in the WP Recipe Maker plugin for WordPress, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It affects all versions up to and including 10.2.2, where the api_get_post_summary function fails to enforce proper access controls on post retrieval. Authenticated attackers with Contributor-level access or above can extract data from posts they are not authorized to view, including password-protected, private, and draft posts. The vulnerability was disclosed on January 16, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, NVD).

The root cause is insufficient access control in the api_get_post_summary function within class-wprm-api-utilities.php, which does not validate whether the requesting user has permission to access the target post (CWE-200). The vulnerable code is located at lines 48, 86, and 172 of the file, where post data is retrieved and returned without checking post visibility or user authorization (NVD). This constitutes an Insecure Direct Object Reference (IDOR) pattern, where an attacker can supply arbitrary post IDs via the API endpoint to retrieve restricted content. The attack is network-based, requires low privileges (Contributor role), low complexity, and no user interaction (Wordfence). A patch diff is publicly available in the WordPress plugin repository changeset (WordPress Trac).

Successful exploitation allows authenticated low-privilege users (Contributors and above) to read the contents of posts that should be inaccessible to them, including password-protected posts, private posts, and unpublished drafts. This poses a confidentiality risk for WordPress sites that store sensitive or embargoed content in non-public post states. There is no integrity or availability impact, and lateral movement beyond the WordPress application is not directly enabled by this vulnerability alone (Wordfence, NVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-15527. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level access, which limits the attacker pool on sites with restricted registration.

1. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site running WP Recipe Maker ≤ 10.2.2.
2. Identify the API Endpoint: Locate the WP Recipe Maker REST API endpoint that invokes api_get_post_summary, typically accessible via the WordPress REST API (e.g., /wp-json/wprm/v1/utilities/post_summary or similar).
3. Enumerate Post IDs: Iterate over numeric post IDs in API requests to discover posts that exist on the site, including those not publicly visible.
4. Request Restricted Posts: Send authenticated API requests supplying the IDs of private, password-protected, or draft posts. The function returns post summary data without validating the requester's access rights.
5. Extract Sensitive Data: Parse the API response to obtain the content, metadata, or other data from posts the attacker should not have access to (Wordfence, NVD).

• Network: Repeated authenticated REST API requests to WP Recipe Maker's post summary endpoint with sequentially or randomly enumerated post IDs from a single user account.
• Logs: WordPress access logs showing a high volume of API calls to /wp-json/wprm/ endpoints from a Contributor-level user, particularly targeting post IDs that correspond to private or draft posts.
• Logs: Requests returning HTTP 200 responses for post IDs that are not publicly accessible, indicating successful unauthorized data retrieval.

Update the WP Recipe Maker plugin to version 10.2.3 or later, which includes a fix that enforces proper access controls in the api_get_post_summary function (Wordfence). As a temporary workaround, site administrators can restrict Contributor-level registration or disable open user registration until the patch is applied. Additionally, reviewing and auditing which users hold Contributor roles or above is advisable to minimize exposure.

Wordfence identified and disclosed the vulnerability, providing the CVE assignment and technical references including the patch changeset (Wordfence). CleanTalk Research published a write-up on the vulnerability (CleanTalk). Community and social media reaction has been minimal, consistent with the medium severity rating and low exploitation probability.