CVE-2026-24357: 
WordPress vulnerability analysis and mitigation

CVE-2026-24357 is a Missing Authorization (Broken Access Control) vulnerability in the WP Recipe Maker WordPress plugin developed by Bootstrapped Ventures (Brecht). It allows authenticated attackers with low-level privileges (Subscriber-level) to exploit incorrectly configured access control security levels, potentially accessing restricted functionality. The vulnerability affects WP Recipe Maker versions up to and including 10.2.4, and was reported on December 29, 2025, with public disclosure on January 22, 2026. The patched version is 10.3.0. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. An authenticated attacker with Subscriber-level access can send crafted network requests to trigger functionality that should be restricted to higher-privileged roles, exploiting incorrectly configured access control security levels. No user interaction is required, and attack complexity is low, making it straightforward to exploit for any authenticated WordPress user. No public technical write-up or proof-of-concept code has been identified (Patchstack).

Successful exploitation allows an authenticated low-privilege user to gain unauthorized access to restricted plugin functionality, with a limited confidentiality impact (read access to data not intended for their role). The CVSS assessment indicates no integrity or availability impact, and scope is unchanged, meaning exploitation is contained to the affected plugin's context. The primary risk is unauthorized disclosure of recipe-related data or plugin configuration details accessible to Subscriber-level users (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

The vendor has released WP Recipe Maker version 10.3.0, which resolves this vulnerability. All users running version 10.2.4 or earlier should update to 10.3.0 or later immediately. As an interim measure, site administrators should restrict user registration and limit Subscriber-level accounts, and consider implementing additional access control at the web server or WAF level. Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically (Patchstack).