{"id":"CVE-2026-110026","kind":"vulnerability","aliases":["CVE-2026-110026"],"related":[],"title":"Tasty Recipes Lite WordPress plugin lets contributors delete any taxonomy term","description":"The Tasty Recipes Lite  WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.","summary":"The Tasty Recipes Lite WordPress plugin before 1.2.11 does not check user capabilities when creating, renaming or deleting taxonomy terms. A logged-in user with the Contributor role can add, rename and permanently delete terms in any taxonomy, including categories, tags and navigation menus.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed version of the Tasty Recipes Lite plugin in the WordPress admin under Plugins; affected if below `1.2.11`\n- Review user accounts with the Contributor role or higher on the site","fix":"- Update Tasty Recipes Lite to `1.2.11` or later","status":"open","published_at":"2026-10-18T07:16:51+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:32:52+00:00","updated_at":"2026-10-25T04:32:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:32:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update Tasty Recipes Lite to `1.2.11` or later","reach":"internet","title":"Tasty Recipes Lite WordPress plugin lets contributors delete any taxonomy term","impact":"medium","summary":"The Tasty Recipes Lite WordPress plugin before 1.2.11 does not check user capabilities when creating, renaming or deleting taxonomy terms. A logged-in user with the Contributor role can add, rename and permanently delete terms in any taxonomy, including categories, tags and navigation menus.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Contributor-level users can permanently delete site taxonomy terms and menus","analyst_note":"","how_to_check":"- Check the installed version of the Tasty Recipes Lite plugin in the WordPress admin under Plugins; affected if below `1.2.11`\n- Review user accounts with the Contributor role or higher on the site","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Sites running the Tasty Recipes Lite plugin before `1.2.11` that have any account with the Contributor role or higher, since those accounts are the ones who can exploit the missing check. Sites without this plugin, or with it already at `1.2.11`, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000589,"input_tokens":3332,"output_tokens":511,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110026':14A,17A '-2026':13A,16A '1.2.11':30B,75C 'add':53B,99C 'allow':89C 'capabl':35B,81C 'categori':63B,112C 'check':33B,79C 'contributor':7A,50B,97C 'correct':78C 'creat':37B,83C 'cve':12A,15A 'delet':8A,40B,57B,86C,103C 'host':21B 'includ':62B,111C 'let':6A 'lite':3A,26B,71C 'log':45B 'logged-in':44B 'low':95C 'menus':67B,116C 'navig':66B,115C 'packag':18B 'perman':56B,102C 'plugin':5A,28B,73C 'recip':2A,25B,70C 'renam':38B,54B,84C,100C 'role':51B,93C 'self':20B 'self-host':19B 'site':110C 'tag':64B,113C 'tasti':1A,24B,69C 'taxonomi':10A,41B,61B,87C,107C 'term':11A,42B,58B,88C,104C 'user':34B,47B,80C,90C 'wordpress':4A,22B,27B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Tasty Recipes Lite plugin before `1.2.11` that have any account with the Contributor role or higher, since those accounts are the ones who can exploit the missing check. Sites without this plugin, or with it already at `1.2.11`, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T07:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110026","severity":null,"published_at":"2026-10-18T07:16:51+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}