https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T21:01:38.849282+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-286236 EUVD-2026-286236 2026-10-08T21:01:38.920297+00:00 EUVD-2026-286236 https://cve.radiocsirt.org/vuln/fkie_cve-2026-1558 fkie_cve-2026-1558 2026-10-08T21:01:38.920341+00:00

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permission_callback being set to __return_true and a lack of subsequent authorization or ownership checks on the user-supplied recipeId. This makes it possible for unauthenticated attackers to overwrite arbitrary post metadata (wprm_instacart_combinations) for any post ID on the site via the recipeId parameter.

 https://cve.radiocsirt.org/vuln/ghsa-2r7h-m6jv-58qc GHSA-2r7h-m6jv-58qc 2026-10-08T21:01:38.920378+00:00

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permission_callback being set to __return_true and a lack of subsequent authorization or ownership checks on the user-supplied recipeId. This makes it possible for unauthenticated attackers to overwrite arbitrary post metadata (wprm_instacart_combinations) for any post ID on the site via the recipeId parameter.