CVE-2026-122060: WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe Disclosure

Q: Who can exploit this issue?

Any unauthenticated user can exploit it. No login or access to the password-protected post is required to retrieve the affected recipe content.

Q: What content may be exposed?

The full content of recipes embedded in password-protected WordPress posts may be disclosed through the plugin's REST API and structured data output.

Q: Are password-protected posts sufficient to prevent disclosure?

No. In affected plugin versions, the plugin does not verify that the containing post is password protected before returning recipe data through the affected outputs.

Q: How can I determine whether my site is affected?

Sites using WP Recipe Maker versions earlier than 10.9.2 are affected when recipes are embedded in password-protected posts. Testing the plugin's REST API or structured-data output for such a post can show whether recipe content is returned without authentication.

Published Nov 8, 2026

Updated

The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.

Event History

Nov 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated user can exploit it. No login or access to the password-protected post is required to retrieve the affected recipe content.

What content may be exposed?

The full content of recipes embedded in password-protected WordPress posts may be disclosed through the plugin's REST API and structured data output.

Are password-protected posts sufficient to prevent disclosure?

No. In affected plugin versions, the plugin does not verify that the containing post is password protected before returning recipe data through the affected outputs.

How can I determine whether my site is affected?

Sites using WP Recipe Maker versions earlier than 10.9.2 are affected when recipes are embedded in password-protected posts. Testing the plugin's REST API or structured-data output for such a post can show whether recipe content is returned without authentication.

CVE-2026-122060: WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe Disclosure

Event History

Frequently Asked Questions

Who can exploit this issue?

What content may be exposed?

Are password-protected posts sufficient to prevent disclosure?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What content may be exposed?

Are password-protected posts sufficient to prevent disclosure?

How can I determine whether my site is affected?