CVE-2026-75905 is an authorization bypass vulnerability in the WP Recipe Maker WordPress plugin affecting all versions up to and including 10.8.0. The plugin fails to properly verify user authorization, allowing authenticated users with contributor-level privileges or higher to change the post_author field of admin-authored recipes to their own user ID, effectively taking ownership. Additionally, these users can unpublish recipes by changing the post_status to draft or pending. The ownership transfer exploit depends on the 'recipe_use_author' setting being set to 'parent', while unpublishing is possible regardless of this setting. This vulnerability is classified under CWE-862 (Missing Authorization).

An attacker with contributor-level access or higher can modify the ownership of recipes created by administrators and unpublish them. This could lead to unauthorized content control and potential disruption of published content on affected WordPress sites. There is no direct confidentiality or availability impact reported. The vulnerability does not require user interaction and has a low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and adjust user permissions carefully, and consider disabling or modifying the 'recipe_use_author' setting if possible to mitigate ownership transfer risk. Monitor plugin updates from the vendor for a security patch addressing this issue.