{"id":"CVE-2026-122060","kind":"vulnerability","aliases":["CVE-2026-122060"],"related":[],"title":"WP Recipe Maker: unauthenticated users can read recipes in protected posts","description":"The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.","summary":"The WP Recipe Maker WordPress plugin returns recipe content through its REST API and structured data even when the host post is password protected. An unauthenticated visitor can read the full recipe text from those protected posts.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-recipe-maker"],"not_affected_if":["no-password-protected-recipes","plugin-version-10.9.2-or-later"],"how_to_check":"- Check the installed version of the WP Recipe Maker plugin in the WordPress admin under Plugins; a version below `10.9.2` is affected.\n- Confirm whether any password-protected posts embed recipes, since only those are exposed.","fix":"- WP Recipe Maker: upgrade to `10.9.2` or later.","status":"open","published_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:15+00:00","updated_at":"2026-11-08T06:47:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T06:47:15Z","model":"claude-haiku-5-5","output":{"fix":"- WP Recipe Maker: upgrade to `10.9.2` or later.","reach":"internet","title":"WP Recipe Maker: unauthenticated users can read recipes in protected posts","impact":"low","summary":"The WP Recipe Maker WordPress plugin returns recipe content through its REST API and structured data even when the host post is password protected. An unauthenticated visitor can read the full recipe text from those protected posts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-recipe-maker"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated visitors read full recipe content from protected posts","analyst_note":"","how_to_check":"- Check the installed version of the WP Recipe Maker plugin in the WordPress admin under Plugins; a version below `10.9.2` is affected.\n- Confirm whether any password-protected posts embed recipes, since only those are exposed.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-10.9.2-or-later","no-password-protected-recipes"],"who_is_affected":"Sites running the WP Recipe Maker WordPress plugin before 10.9.2 that embed recipes in password-protected posts. The REST API and structured data output are the exposed paths; sites without protected posts containing recipes have less to lose.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000715,"input_tokens":4541,"output_tokens":521,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122060':14A,17A '-2026':13A,16A '10.9.2':68C 'allow':95C 'api':36B,90C 'check':71C 'content':32B,102C 'cve':12A,15A 'data':39B,93C 'embed':78C 'even':40B 'full':54B,101C 'host':43B 'maker':3A,23B,27B,64C 'output':94C 'packag':18B 'password':46B,81C,107C 'password-protect':106C 'plugin':29B,66C 'post':11A,44B,60B,74C,109C 'protect':10A,47B,59B,82C,108C 'read':7A,52B,99C 'recip':2A,8A,22B,26B,31B,55B,63C,76C,86C,104C 'rest':35B,89C 'return':30B,84C 'structur':38B,92C 'text':56B 'unauthent':4A,49B,96C 'user':5A,97C 'visitor':50B 'whether':72C 'wordpress':19B,28B,65C 'wp':1A,21B,25B,62C 'wp-recipe-mak':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Recipe Maker WordPress plugin before 10.9.2 that embed recipes in password-protected posts. The REST API and structured data output are the exposed paths; sites without protected posts containing recipes have less to lose.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wordpress","wprecipemaker"],"campaign_type":null,"search_a":"'-122060':14A,17A '-2026':13A,16A 'cve':12A,15A 'maker':3A 'post':11A 'protect':10A 'read':7A 'recip':2A,8A 'unauthent':4A 'user':5A 'wp':1A","search_b":"'api':36B 'content':32B 'data':39B 'even':40B 'full':54B 'host':43B 'maker':23B,27B 'packag':18B 'password':46B 'plugin':29B 'post':44B,60B 'protect':47B,59B 'read':52B 'recip':22B,26B,31B,55B 'rest':35B 'return':30B 'structur':38B 'text':56B 'unauthent':49B 'visitor':50B 'wordpress':19B,28B 'wp':21B,25B 'wp-recipe-mak':20B","search_c":"'10.9.2':68C 'allow':95C 'api':90C 'check':71C 'content':102C 'data':93C 'embed':78C 'full':101C 'maker':64C 'output':94C 'password':81C,107C 'password-protect':106C 'plugin':66C 'post':74C,109C 'protect':82C,108C 'read':99C 'recip':63C,76C,86C,104C 'rest':89C 'return':84C 'structur':92C 'unauthent':96C 'user':97C 'whether':72C 'wordpress':65C 'wp':62C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122060","severity":null,"published_at":"2026-11-08T06:17:04+00:00","modified_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}