The WP Recipe Maker plugin for WordPress suffers from an authorization bypass vulnerability (CWE-639) due to missing capability checks on AJAX functions 'ajax_search_recipes' and 'ajax_get_recipe'. Authenticated users with Subscriber-level privileges or above can exploit this flaw to retrieve sensitive recipe information that should be restricted, such as drafts, pending, and private recipes. The vulnerability affects all versions up to 10.2.3. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges but no user interaction, and resulting in limited confidentiality impact without integrity or availability effects.

An attacker with at least Subscriber-level access can access sensitive recipe data that should be restricted, potentially exposing unpublished or private content. The impact is limited to confidentiality, with no reported effects on integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to recipe data access. Avoid granting unnecessary privileges to users and consider disabling or limiting use of the affected AJAX functions if possible.