The WP Recipe Maker plugin for WordPress versions up to 10.3.2 contains an IDOR vulnerability (CWE-639) in its REST API endpoint /wp-json/wp-recipe-maker/v1/integrations/instacart. The endpoint's permission_callback is set to __return_true, effectively disabling permission checks. Additionally, no authorization or ownership validation is performed on the recipeId parameter supplied by users. As a result, unauthenticated attackers can overwrite the wprm_instacart_combinations post metadata for any post ID on the site, potentially altering recipe data without authorization.

The vulnerability allows unauthenticated attackers to modify post metadata arbitrarily for any post on the affected WordPress site. While it does not disclose sensitive information or allow direct code execution, it can lead to unauthorized data manipulation, impacting data integrity and potentially disrupting site functionality related to recipes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, site administrators should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the vulnerable REST API endpoint via web application firewall rules or other access controls to prevent exploitation.