CVE-2026-1558: WP Recipe Maker Auth Bypass Vulnerability

CVE-2026-1558 Overview

CVE-2026-1558 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the WP Recipe Maker plugin for WordPress in versions up to and including 10.3.2. The flaw resides in the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint. The endpoint declares its permission_callback as __return_true and performs no authorization or ownership checks on the user-supplied recipeId. Unauthenticated attackers can overwrite arbitrary post metadata, specifically the wprm_instacart_combinations key, for any post ID on the affected site. The issue is tracked under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated attackers can overwrite the wprm_instacart_combinations post metadata on any post ID, affecting site integrity without requiring credentials or user interaction.

Affected Products

WP Recipe Maker plugin for WordPress, versions up to and including 10.3.2
WordPress sites exposing the /wp-json/wp-recipe-maker/v1/integrations/instacart REST endpoint
Any post type on the site that can be referenced by a numeric ID through the vulnerable endpoint

Discovery Timeline

2026-02-27 - CVE-2026-1558 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1558

Vulnerability Analysis

The WP Recipe Maker plugin registers a custom REST API route to support its Instacart integration. The route handler at class-wprm-api-integrations.php sets the permission_callback argument to __return_true, which instructs WordPress to grant access to every caller, including unauthenticated visitors. The downstream handler in class-wprm-instacart.php accepts a recipeId parameter from the request body and writes the wprm_instacart_combinations post meta value using that ID. The handler does not verify that the supplied ID corresponds to a recipe post, nor that the caller has rights to modify it. As a result, the access control decision is delegated entirely to a value the attacker controls.

Root Cause

The root cause is missing authorization at the REST route level combined with absent ownership validation in the metadata writer. Returning __return_true from a permission_callback bypasses WordPress capability checks. The plugin compounds the issue by trusting recipeId as authoritative without calling current_user_can('edit_post', $recipeId) or verifying the post type matches wprm_recipe.

Attack Vector

An unauthenticated attacker sends an HTTP POST request to /wp-json/wp-recipe-maker/v1/integrations/instacart with a recipeId value pointing to any post on the site. The endpoint writes attacker-controlled data into the wprm_instacart_combinations meta key for that post. Repeated requests allow mass overwriting of post metadata across the site. The attack is network-based, requires no privileges, and needs no user interaction. Source references: WordPress Plugin API File and WordPress Instacart Integration.

No verified proof-of-concept code is published. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-1558

Indicators of Compromise

HTTP requests to /wp-json/wp-recipe-maker/v1/integrations/instacart from unauthenticated sources or unexpected IP ranges
Unexplained changes to the wprm_instacart_combinations post meta key on non-recipe post types
Multiple requests iterating sequential recipeId values within short timeframes

Detection Strategies

Review web server access logs for POST requests to the vulnerable Instacart REST endpoint and correlate with unauthenticated sessions
Query the wp_postmeta table for recent entries with meta_key = 'wprm_instacart_combinations' attached to posts that are not of type wprm_recipe
Enable WordPress audit logging to capture post meta modifications and flag writes occurring without an authenticated user context

Monitoring Recommendations

Monitor REST API traffic for high-volume calls to wp-json/wp-recipe-maker/v1/integrations/* endpoints
Alert on metadata write operations from unauthenticated REST sessions
Track plugin version inventory across WordPress installations to identify hosts still running WP Recipe Maker 10.3.2 or earlier

How to Mitigate CVE-2026-1558

Immediate Actions Required

Update WP Recipe Maker to the version released in WordPress Plugin Changeset 3464195 or later
Audit wp_postmeta rows with meta_key = 'wprm_instacart_combinations' and remove or restore any tampered values
Restrict access to the /wp-json/wp-recipe-maker/v1/integrations/instacart endpoint at the web application firewall until patching is complete

Patch Information

The vendor addressed the issue in the changeset published at WordPress Plugin Changeset. The fix replaces the permissive permission_callback and introduces authorization checks against the supplied recipeId. Site administrators should upgrade through the WordPress plugin dashboard or by deploying the fixed package from the plugin repository.

Workarounds

Deactivate the WP Recipe Maker plugin until the patched release is installed
Block requests to /wp-json/wp-recipe-maker/v1/integrations/instacart at the reverse proxy or WAF layer
Restrict REST API access to authenticated users using a hardening plugin or custom rest_authentication_errors filter

bash

# Example nginx rule to block the vulnerable endpoint until patched
location ~ ^/wp-json/wp-recipe-maker/v1/integrations/instacart {
    return 403;
}