CVE-2026-1558: WP Recipe Maker Auth Bypass Vulnerability

CVE-2026-1558 Overview

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This vulnerability exists due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permission_callback being set to __return_true and a lack of subsequent authorization or ownership checks on the user-supplied recipeId. This makes it possible for unauthenticated attackers to overwrite arbitrary post metadata (wprm_instacart_combinations) for any post ID on the site via the recipeId parameter.

Critical Impact

Unauthenticated attackers can manipulate post metadata across any WordPress post, potentially affecting site integrity and the behavior of Instacart shopping integrations on recipe content.

Affected Products

• WP Recipe Maker plugin for WordPress versions up to and including 10.3.2
• WordPress sites utilizing WP Recipe Maker's Instacart integration feature
• Any WordPress installation with the vulnerable REST API endpoint exposed

Discovery Timeline

• February 27, 2026 - CVE-2026-1558 published to NVD
• February 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1558

Vulnerability Analysis

This Insecure Direct Object Reference (IDOR) vulnerability (CWE-639) stems from improper access control in the WP Recipe Maker plugin's REST API implementation. The vulnerability allows attackers to bypass authorization mechanisms entirely, as the API endpoint responsible for handling Instacart integration data lacks proper authentication and ownership validation.

The core issue lies in the REST API endpoint configuration where the permission_callback function is set to __return_true, a WordPress function that simply returns true without performing any actual permission checks. This effectively makes the endpoint publicly accessible to anyone, including unauthenticated users. Combined with the absence of subsequent checks to verify whether the requesting user has legitimate access to the specified recipeId, attackers can target and modify metadata for any post on the WordPress site.

Root Cause

The root cause of this vulnerability is the misconfiguration of the REST API endpoint's permission callback mechanism. In the WordPress Plugin API Integration code, the permission_callback is set to __return_true, which bypasses all authentication requirements. Additionally, the Instacart integration handler fails to implement authorization checks to verify that the requesting user owns or has permission to modify the specified recipe post.

This architectural flaw allows any external party to submit API requests that modify the wprm_instacart_combinations metadata field for arbitrary post IDs, as the recipeId parameter is processed without validation against the current user's permissions.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted HTTP requests directly to the vulnerable REST API endpoint. The attack process involves:

1. Identifying a target WordPress site running a vulnerable version of WP Recipe Maker
2. Crafting a malicious API request to /wp-json/wp-recipe-maker/v1/integrations/instacart with an arbitrary recipeId
3. Submitting the request to overwrite the wprm_instacart_combinations post metadata for the targeted post ID

Since no authentication is required and the recipeId parameter is not validated against user permissions, attackers can systematically target any post on the WordPress site, not just recipe posts created by the plugin.

Detection Methods for CVE-2026-1558

Indicators of Compromise

• Unexpected modifications to post metadata, specifically the wprm_instacart_combinations field
• Unusual API request patterns targeting the /wp-json/wp-recipe-maker/v1/integrations/instacart endpoint
• High volumes of requests from unauthenticated sources to the vulnerable REST API endpoint
• Changes to Instacart shopping integration data on recipe posts without corresponding administrative activity

Detection Strategies

• Monitor WordPress REST API access logs for requests to the wp-recipe-maker/v1/integrations/instacart endpoint from unauthenticated users
• Implement web application firewall (WAF) rules to detect and alert on suspicious parameter patterns in requests to the vulnerable endpoint
• Review WordPress post metadata tables for unauthorized changes to the wprm_instacart_combinations field
• Use SentinelOne Singularity to monitor for anomalous network traffic patterns targeting WordPress REST API endpoints

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests, particularly for plugin-specific endpoints
• Set up alerts for bulk or repeated requests to the vulnerable endpoint from single IP addresses
• Implement integrity monitoring for WordPress post metadata to detect unauthorized modifications
• Consider deploying a WordPress security plugin with REST API monitoring capabilities

How to Mitigate CVE-2026-1558

Immediate Actions Required

• Update WP Recipe Maker plugin to the latest patched version immediately
• Temporarily disable the Instacart integration feature if the plugin cannot be updated immediately
• Review post metadata for signs of unauthorized modifications, particularly the wprm_instacart_combinations field
• Implement WAF rules to block unauthenticated requests to the vulnerable REST API endpoint

Patch Information

The vendor has released a security patch addressing this vulnerability. The fix can be reviewed in the WordPress Recipe Maker Changeset. Users should update to the latest version of WP Recipe Maker available through the WordPress plugin repository. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Restrict access to the WordPress REST API for unauthenticated users using a security plugin or web server configuration
• Implement IP-based access controls for the /wp-json/wp-recipe-maker/v1/integrations/instacart endpoint
• Use a web application firewall to filter and block malicious requests targeting the vulnerable endpoint
• Disable the WP Recipe Maker plugin entirely until a patch can be applied if the Instacart integration is not critical to site functionality

# Apache .htaccess workaround to block unauthenticated access to vulnerable endpoint
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/wp-recipe-maker/v1/integrations/instacart [NC]
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule .* - [F,L]
</IfModule>