CVE-2026-75905 Overview
CVE-2026-75905 is an authorization bypass vulnerability in the WP Recipe Maker plugin for WordPress. The flaw affects all versions up to and including 10.8.0. The plugin fails to properly verify that a user is authorized to perform recipe modification actions. Authenticated attackers with contributor-level access or above can take ownership of admin-authored recipes by rewriting the post_author field to their own user ID. Attackers can also unpublish recipes by overwriting the post_status with a contributor's draft or pending status. The vulnerability is tracked under CWE-862: Missing Authorization.
Critical Impact
Authenticated contributors can hijack ownership of admin-authored recipes and unpublish content, disrupting site integrity and content availability.
Affected Products
- WP Recipe Maker plugin for WordPress
- All versions up to and including 10.8.0
- WordPress sites permitting contributor-level or higher registrations
Discovery Timeline
- 2026-09-09 - CVE-2026-75905 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-75905
Vulnerability Analysis
The vulnerability resides in the recipe saving logic of WP Recipe Maker, specifically within class-wprm-recipe-saver.php. The plugin exposes recipe modification functionality to authenticated users but does not validate whether the requesting user owns the recipe or holds sufficient privileges to modify it. Attackers with contributor-level accounts can therefore submit crafted requests that alter recipe metadata belonging to administrators.
Two distinct impacts result from the flaw. First, an attacker can rewrite the post_author field, transferring ownership of the recipe from an administrator to the attacker's account. Second, the attacker can overwrite post_status with draft or pending, effectively unpublishing the recipe from the live site.
The ownership transfer requires the recipe_use_author setting to remain at its default value of parent. The unpublish action succeeds regardless of that configuration.
Root Cause
The root cause is missing authorization checks in the recipe update handler. The plugin trusts client-supplied identifiers and metadata without confirming that the authenticated session has the WordPress capability to edit the target post. This maps directly to CWE-862: Missing Authorization.
Attack Vector
Exploitation requires network access to the WordPress site and an authenticated account holding at least the contributor role. The attacker sends a request to the vulnerable recipe save endpoint referencing an admin-authored recipe ID and supplies their own user ID as the post_author value along with a restricted post_status. Because the plugin does not enforce ownership or capability checks, the update succeeds. Relevant code paths appear at class-wprm-recipe-saver.php L572, L630, and L729.
No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-75905
Indicators of Compromise
- Recipes previously authored by administrators showing a contributor account as the new author in WordPress wp_posts.post_author.
- Admin-authored recipes suddenly transitioning to draft or pending status without a corresponding administrator action in the audit log.
- Unexpected POST requests to WP Recipe Maker AJAX or REST endpoints originating from low-privilege user sessions.
Detection Strategies
- Query the WordPress database for recipes where post_author no longer matches the historical author recorded in revisions.
- Correlate WordPress user role data against recent post_status changes for the wprm_recipe custom post type.
- Review web server access logs for contributor-authenticated requests targeting recipe save endpoints in class-wprm-recipe-saver.php.
Monitoring Recommendations
- Enable WordPress audit logging to capture post_author and post_status modifications on recipe custom post types.
- Alert on privilege changes and content ownership transfers affecting administrator-owned posts.
- Track plugin version inventory across managed WordPress sites to identify hosts still running WP Recipe Maker 10.8.0 or earlier.
How to Mitigate CVE-2026-75905
Immediate Actions Required
- Update the WP Recipe Maker plugin to a version later than 10.8.0 that contains the fix referenced in the WordPress Plugin Changeset.
- Audit existing recipes to confirm post_author values reflect the original administrators and restore any hijacked ownership.
- Review contributor and author accounts for unexpected registrations or suspicious activity.
Patch Information
The vendor addressed the missing authorization checks in the release following 10.8.0. The corresponding fix is documented in the WordPress Plugin Changeset. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI.
Workarounds
- Restrict contributor and author account registrations on public WordPress sites until the plugin is updated.
- Change the recipe_use_author setting away from the default parent value to prevent the ownership transfer path, while noting that unpublish attacks remain viable.
- Deploy a web application firewall rule that blocks recipe save requests carrying post_author or restricted post_status fields from non-editor sessions.
# Update WP Recipe Maker via WP-CLI to the patched release
wp plugin update wp-recipe-maker
wp plugin get wp-recipe-maker --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
