https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:54:49 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-75905 <p>The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to take ownership of any admin-authored recipe by rewriting its post_author to the attacker&#39;s user ID, and unpublish it by overwriting its post_status with the contributor&#39;s draft or pending post status. This requires the default &#39;recipe_use_author&#39; setting to be set to &#39;parent&#39; for the ownership transfer to occur, though unpublishing remains possible regardless of this setting.</p> <p>The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to take ownership of any admin-authored recipe by rewriting its post_author to the attacker&#39;s user ID, and unpublish it by overwriting its post_status with the contributor&#39;s draft or pending post status. This requires the default &#39;recipe_use_author&#39; setting to be set to &#39;parent&#39; for the ownership transfer to occur, though unpublishing remains possible regardless of this setting.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-75905 https://vulnerability.circl.lu/vuln/ghsa-hxrm-g829-m3g6 <p>The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to take ownership of any admin-authored recipe by rewriting its post_author to the attacker&#39;s user ID, and unpublish it by overwriting its post_status with the contributor&#39;s draft or pending post status. This requires the default &#39;recipe_use_author&#39; setting to be set to &#39;parent&#39; for the ownership transfer to occur, though unpublishing remains possible regardless of this setting.</p> <p>The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to take ownership of any admin-authored recipe by rewriting its post_author to the attacker&#39;s user ID, and unpublish it by overwriting its post_status with the contributor&#39;s draft or pending post status. This requires the default &#39;recipe_use_author&#39; setting to be set to &#39;parent&#39; for the ownership transfer to occur, though unpublishing remains possible regardless of this setting.</p> https://vulnerability.circl.lu/vuln/ghsa-hxrm-g829-m3g6