---
id: "CVE-2026-122060"
page: "https://infrastack.ai/live/CVE-2026-122060"
kind: "vulnerability"
aliases: ["CVE-2026-122060"]
title: "WP Recipe Maker: unauthenticated users can read recipes in protected posts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wp-recipe-maker"]
not_affected_if: ["no-password-protected-recipes", "plugin-version-10.9.2-or-later"]
published_at: "2026-11-08T06:17:04+00:00"
first_seen_at: "2026-11-08T06:46:21+00:00"
updated_at: "2026-11-08T06:47:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122060", "first_seen_at": "2026-11-08T06:46:21+00:00"}]
exploit_sources: []
---

# WP Recipe Maker: unauthenticated users can read recipes in protected posts

Link for people: https://infrastack.ai/live/CVE-2026-122060 (this .md is for agents)

The WP Recipe Maker WordPress plugin returns recipe content through its REST API and structured data even when the host post is password protected. An unauthenticated visitor can read the full recipe text from those protected posts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the WP Recipe Maker plugin in the WordPress admin under Plugins; a version below `10.9.2` is affected.
- Confirm whether any password-protected posts embed recipes, since only those are exposed.

## Fix

- WP Recipe Maker: upgrade to `10.9.2` or later.

## Timeline

- 2026-11-08T06:46:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122060

## From the sources

The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_