CVE-2026-14305 Overview
CVE-2026-14305 affects the WP Delicious WordPress plugin in versions prior to 1.10.2. The plugin exposes an AJAX action that does not perform an authorization check. Unauthenticated users can invoke the action to modify limited post metadata on arbitrary posts, including a like counter and an associated identifier list. Attackers can inflate the counter and grow the stored metadata without bound.
The issue is a Broken Access Control flaw stemming from missing authorization on an exposed endpoint. Public WordPress sites running the vulnerable plugin can be manipulated by any remote actor without authentication.
Critical Impact
Unauthenticated remote users can tamper with post metadata across arbitrary posts and continuously expand database records, enabling data integrity abuse and storage exhaustion.
Affected Products
- WP Delicious WordPress plugin versions prior to 1.10.2
- WordPress sites with the plugin installed and active
- Any post exposed by the WordPress instance running the vulnerable plugin
Discovery Timeline
- 2026-07-30 - CVE-2026-14305 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-14305
Vulnerability Analysis
The WP Delicious plugin registers an AJAX action that accepts requests from unauthenticated users. The handler updates two pieces of post metadata: a like counter and a list of identifiers associated with the like. The handler does not verify the caller's identity or permission to modify the target post. As a result, any remote client can submit requests that mutate metadata for arbitrary post IDs.
Because the identifier list grows on each request without validation of size or duplication constraints, an attacker can drive unbounded growth of a wp_postmeta row. This produces database bloat and potential performance degradation. The counter can also be inflated to arbitrary values, corrupting analytics and public content presentation.
Root Cause
The root cause is the absence of an authorization check on the AJAX action handler. The plugin registers the action for both wp_ajax_ and wp_ajax_nopriv_ hooks without calling current_user_can(), verifying a nonce with check_ajax_referer(), or otherwise validating the request origin. This maps to CWE-862 (Missing Authorization).
Attack Vector
An unauthenticated attacker sends crafted HTTP POST requests to wp-admin/admin-ajax.php specifying the vulnerable action and a target post ID. Each request updates the like counter and appends to the associated identifier list. Repeated requests can be issued from any client capable of reaching the site. No user interaction, elevated privilege, or session context is required. Further technical details are available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-14305
Indicators of Compromise
- Repeated POST requests to /wp-admin/admin-ajax.php referencing the WP Delicious like action from unauthenticated sources
- Abnormally large values in wp_postmeta rows tied to WP Delicious like counters or identifier lists
- Sudden increases in post like counts on recipes or posts that do not correspond to organic traffic patterns
Detection Strategies
- Review web server access logs for high-volume, low-diversity POST requests to admin-ajax.php from single IPs or subnets
- Query wp_postmeta for outlier sizes of like-related meta keys registered by the WP Delicious plugin
- Alert on unauthenticated AJAX actions invoked at abnormal request rates against WordPress endpoints
Monitoring Recommendations
- Enable request logging on the WordPress front-end with fields for URI, action parameter, and authentication state
- Monitor database table growth for wp_postmeta and alert on sudden row-size increases
- Correlate WAF telemetry with AJAX endpoint traffic to identify automated abuse
How to Mitigate CVE-2026-14305
Immediate Actions Required
- Update the WP Delicious plugin to version 1.10.2 or later on all WordPress sites
- Audit wp_postmeta for inflated counters or oversized identifier lists and restore known-good values from backups
- Block or rate-limit unauthenticated requests to admin-ajax.php at the WAF or reverse proxy
Patch Information
The vendor addressed the flaw in WP Delicious 1.10.2 by adding an authorization check to the affected AJAX action. Administrators should apply the update through the WordPress plugin manager or by deploying the patched release directly. Consult the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate and remove the WP Delicious plugin until the update to 1.10.2 or later can be deployed
- Deploy a WAF rule that blocks unauthenticated POST requests carrying the vulnerable AJAX action parameter
- Restrict access to admin-ajax.php for anonymous clients where the site's functionality permits
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
