CVE-2026-110026: Tasty Recipes Lite Auth Bypass Vulnerability

CVE-2026-110026 Overview

CVE-2026-110026 is a broken access control vulnerability in the Tasty Recipes Lite WordPress plugin before version 1.2.11. The plugin fails to verify user capabilities when creating, renaming, and deleting taxonomy terms. Authenticated users with a role as low as Contributor can add, rename, and permanently delete terms in any taxonomy on the site. The affected taxonomies include categories, tags, and navigation menus. The vulnerability maps to CWE-862: Missing Authorization.

Critical Impact

Low-privileged Contributor accounts can destroy or rename site taxonomy data, including categories, tags, and navigation menus, disrupting site structure and content organization.

Affected Products

• Tasty Recipes Lite WordPress plugin versions prior to 1.2.11
• WordPress sites allowing Contributor-level registration with the plugin active
• Any WordPress taxonomy managed on the affected site, including categories, tags, and navigation menus

Discovery Timeline

• 2026-10-18 - CVE-2026-110026 published to the National Vulnerability Database
• 2026-10-19 - Last updated in the NVD database

Technical Details for CVE-2026-110026

Vulnerability Analysis

The Tasty Recipes Lite plugin exposes administrative actions for taxonomy term management without validating that the requesting user holds the appropriate capability. WordPress enforces capability checks through functions such as current_user_can() to gate privileged operations like manage_categories or edit_theme_options. The plugin omits these checks on its create, rename, and delete handlers.

As a result, a user authenticated with the Contributor role, which is normally restricted to drafting posts, can invoke the plugin's handlers and operate on any taxonomy registered on the site. Because the handlers do not scope the operation to the plugin's own recipe taxonomies, actions propagate to core taxonomies including category, post_tag, and nav_menu.

Root Cause

The root cause is missing authorization [CWE-862]. The plugin registers endpoints that perform taxonomy mutations but does not call capability checks before executing the requested action. Nonce verification, if present, only confirms request intent and does not establish authorization.

Attack Vector

An attacker needs valid Contributor credentials on the target site. The attacker sends an authenticated request to the plugin's taxonomy management endpoint and specifies the target taxonomy and term. The server executes the operation without rejecting the low-privileged caller. Repeating the request against navigation menu items can break site navigation; repeating it against categories or tags can permanently remove content classifications. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-110026

Indicators of Compromise

• Unexpected deletion or renaming of WordPress categories, tags, or navigation menu items without a corresponding administrator action
• Authenticated POST requests from Contributor-role users to Tasty Recipes Lite plugin endpoints that invoke taxonomy create, rename, or delete actions
• WordPress audit log entries showing created_term, edited_term, or delete_term events initiated by non-privileged accounts

Detection Strategies

• Enable a WordPress activity logging plugin and alert on taxonomy mutation events performed by users below the Editor role
• Correlate web server access logs with user session data to flag Contributor accounts posting to plugin admin-ajax or REST endpoints
• Hook into the created_term, edited_term, and delete_term WordPress actions to log the acting user and reject unexpected callers

Monitoring Recommendations

• Monitor the wp_terms and wp_term_taxonomy tables for unexpected row changes outside of maintenance windows
• Track creation of new Contributor accounts, especially from self-service registration, and review their recent activity
• Alert on repeated 200-status responses to Tasty Recipes Lite endpoints originating from the same low-privileged session

How to Mitigate CVE-2026-110026

Immediate Actions Required

• Update the Tasty Recipes Lite plugin to version 1.2.11 or later on all WordPress installations
• Audit existing Contributor and Subscriber accounts and remove any that are unused or unrecognized
• Review categories, tags, and navigation menus for unauthorized changes and restore from backup where needed
• Temporarily disable the plugin on sites that cannot be patched immediately

Patch Information

Upgrade to Tasty Recipes Lite version 1.2.11 or later. The fixed release adds the missing capability checks on the taxonomy create, rename, and delete handlers. Confirm the installed version from the WordPress Plugins screen after update.

Workarounds

• Disable open user registration or restrict new accounts to the Subscriber role with no posting rights
• Use a role management plugin to remove unnecessary capabilities from the Contributor role on the affected site
• Place the WordPress admin area behind an authentication proxy or IP allowlist until the plugin is updated

# Verify plugin version and update via WP-CLI
wp plugin get tasty-recipes-lite --field=version
wp plugin update tasty-recipes-lite --version=1.2.11
wp user list --role=contributor --fields=ID,user_login,user_registered