CVE-2026-73999: WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability
Published Sep 17, 2026
·Updated
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
Affected Software
1 affected component
WordPress Cooked plugin<=1.16.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Cooked pluginto a version that resolves this vulnerability.Fixed in 1.16.1
Event History
Sep 17, 2026
CVE Published
via MITRE·01:24 PM
Data Sourced
via MITRE·01:24 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs Contributor-level access to a WordPress site using the Cooked plugin version 1.16.0 or earlier.
2
What is the potential impact?
The vulnerability can affect integrity and availability, while no confidentiality impact is indicated by the supplied CVSS vector.