The WP Recipe Maker plugin for WordPress contains a missing authorization vulnerability (CVE-2026-24357) due to incorrectly configured access control security levels. This flaw allows an attacker with low privileges to access certain resources or functions without proper authorization. The vulnerability affects all versions up to 10.2.4. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no user interaction, impacting confidentiality to a limited extent. No vendor advisory or patch information is available to confirm remediation status.

An attacker with low privileges can exploit this vulnerability remotely to bypass authorization controls, potentially gaining unauthorized access to certain data or functionality within the WP Recipe Maker plugin. The impact is limited to confidentiality with no reported effects on integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from the vendor and consider restricting access to the affected plugin features to trusted users only.