CVE-2026-122060 · Package
NO FIX YET · SEE WHAT TO DO
The WP Recipe Maker WordPress plugin returns recipe content through its REST API and structured data even when the host post is password protected. An unauthenticated visitor can read the full recipe text from those protected posts.
first public Nov 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WP Recipe Maker WordPress plugin before 10.9.2 that embed recipes in password-protected posts. The REST API and structured data output are the exposed paths; sites without protected posts containing recipes have less to lose.
Not affected if no-password-protected-recipes, plugin-version-10.9.2-or-later
Who cares wordpress, wp-recipe-maker
10.9.2 is affected.10.9.2 or later.The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.