Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permission_callback being set to __return_true and a lack of subsequent authorization or ownership checks on the user-supplied recipeId. This makes it possible for unauthenticated attackers to overwrite arbitrary post metadata (wprm_instacart_combinations) for any post ID on the site via the recipeId parameter.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1558 The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is due to the /wp-js… https://www.cve.org/CVERecord?id=CVE-2026-1558
Post summary
The WP Recipe Maker plugin for WordPress contains an IDOR flaw affecting versions up to 10.3.2, as identified by CVE-2026-1558.
CVE-2026-1558 IDOR Vulnerability in WP Recipe Maker Plugin Allows Unauthorized Metadata Modification https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1558
Post summary
CVE-2026-1558 is an IDOR vulnerability in the WP Recipe Maker plugin that allows unauthorized modification of metadata.