CVE-2025-15527: WP Recipe Maker Information Disclosure

CVE-2025-15527 Overview

The WP Recipe Maker plugin for WordPress contains an Information Exposure vulnerability in versions up to and including 10.2.2. The flaw exists in the api_get_post_summary function, which fails to implement sufficient restrictions on which posts can be retrieved through the API. This allows authenticated attackers with Contributor-level access or above to extract data from posts they would not normally be authorized to access, including password-protected, private, or draft posts.

Critical Impact

Authenticated users with low-privilege Contributor accounts can bypass access controls to read sensitive content from protected posts, potentially exposing confidential information stored in draft or private recipe posts.

Affected Products

• WP Recipe Maker plugin for WordPress versions up to and including 10.2.2
• WordPress installations utilizing the vulnerable WP Recipe Maker plugin
• Sites with multi-author configurations where access control is critical

Discovery Timeline

• 2026-01-16 - CVE-2025-15527 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2025-15527

Vulnerability Analysis

This Information Exposure vulnerability (CWE-200) stems from inadequate authorization checks in the WP Recipe Maker plugin's API utilities. The api_get_post_summary function within the class-wprm-api-utilities.php file processes requests to retrieve post summaries without properly verifying whether the requesting user has legitimate access to view the target post content.

WordPress implements a robust capability system that controls user access to content based on post status (published, draft, private, password-protected) and user roles. The vulnerable function bypasses these built-in protections by failing to check post visibility permissions before returning post data, effectively allowing any authenticated user with at least Contributor-level privileges to query and retrieve information about any post in the system.

Root Cause

The root cause lies in the insufficient access control implementation within the plugin's API endpoint. The api_get_post_summary function located at lines 48, 86, and 172 of class-wprm-api-utilities.php does not validate whether the requesting user has the appropriate capabilities to view the requested post before returning its content. This missing authorization check allows the function to return post data regardless of the post's visibility settings or the user's relationship to that content.

Attack Vector

An attacker with valid WordPress credentials at the Contributor level or above can exploit this vulnerability by making API requests to the api_get_post_summary endpoint with post IDs they do not have permission to access. The attack is network-based and requires no user interaction, making it straightforward to execute.

The exploitation flow involves:

1. Authenticating to WordPress with a low-privilege account (Contributor or higher)
2. Enumerating or guessing post IDs for private, draft, or password-protected content
3. Making API requests to the vulnerable endpoint with target post IDs
4. Receiving unauthorized access to post summary data that should be restricted

Technical details and the specific code changes addressing this vulnerability can be found in the WordPress Changeset Update.

Detection Methods for CVE-2025-15527

Indicators of Compromise

• Unusual API activity from Contributor or Author-level user accounts accessing post summaries
• Multiple requests to the WP Recipe Maker API endpoints targeting sequential or non-sequential post IDs
• Access logs showing authenticated users retrieving data for posts they did not create or have edit access to
• Elevated API request volumes from low-privilege accounts

Detection Strategies

• Monitor WordPress API endpoints for requests to /wp-json/ routes associated with WP Recipe Maker utilities
• Implement logging for all api_get_post_summary function calls including the requesting user and target post ID
• Configure web application firewall (WAF) rules to flag suspicious patterns of post ID enumeration
• Review access logs for authenticated users accessing private or draft post content through API routes

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests, particularly those involving the WP Recipe Maker plugin
• Set up alerts for anomalous access patterns, such as users accessing posts outside their normal workflow
• Regularly audit Contributor and Author account activities for signs of reconnaissance or data harvesting
• Implement rate limiting on API endpoints to slow potential enumeration attacks

How to Mitigate CVE-2025-15527

Immediate Actions Required

• Update WP Recipe Maker plugin to a version newer than 10.2.2 that includes the security patch
• Review user accounts with Contributor-level access and above for any suspicious activity
• Audit access logs to determine if the vulnerability may have been exploited before patching
• Consider temporarily restricting Contributor account creation until the update is applied

Patch Information

The vulnerability has been addressed by the plugin developers. The security fix can be reviewed in the WordPress Changeset Update. Additional details are available in the Wordfence Vulnerability Report.

Site administrators should update the WP Recipe Maker plugin through the WordPress admin dashboard or via WP-CLI as soon as possible.

Workarounds

• Temporarily disable the WP Recipe Maker plugin if immediate patching is not possible
• Restrict user registration and limit Contributor-level account creation until the patch is applied
• Use a Web Application Firewall (WAF) to filter suspicious API requests targeting WP Recipe Maker endpoints
• Review and remove unnecessary Contributor accounts that do not require API access

# Update WP Recipe Maker via WP-CLI
wp plugin update wp-recipe-maker

# Verify the installed version is patched
wp plugin get wp-recipe-maker --field=version

# List all users with Contributor role for audit
wp user list --role=contributor --fields=ID,user_login,user_email