CVE-2025-15527

The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the api_get_post_summary function due to insufficient restrictions on which posts can be retrieved. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from posts they may not be able to edit or read otherwise. This also affects password protected, private, or draft posts that they should not have access to.

• CWE-200

• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php#L172
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php#L48
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php#L86
• https://plugins.trac.wordpress.org/changeset/3415263/wp-recipe-maker/trunk/includes/public/api/class-wprm-api-utilities.php?contextall=1&old=3402554&old_path=%2Fwp-recipe-maker%2Ftrunk%2Fincludes%2Fpublic%2Fapi%2Fclass-wprm-api-utilities.php
• https://research.cleantalk.org/cve-2025-15527/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/96f77fdc-4e91-43c0-8bc6-7bb202945c7d?source=cve

Published

Jan 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-15521The Academy LMS – WordPress LMS Plugin for Complete eLearnin…9.8
• CVE-2025-15522The Uncanny Automator – Easy Automation, Integration, Webhoo…6.4
• CVE-2025-15523MacOS version of Inkscape bundles a Python interpreter that …4.8
• CVE-2025-15524The Gallery by FooGallery plugin for WordPress is vulnerable…4.3
• CVE-2025-15525The Ajax Load More – Infinite Scroll, Load More, & Lazy Load…5.3
• CVE-2025-15526The Fancy Product Designer plugin for WordPress is vulnerabl…5.3
• CVE-2025-15528A vulnerability has been found in Open5GS up to 2.7.6. Affec…7.5
• CVE-2025-15529A vulnerability was found in Open5GS up to 2.7.6. Affected b…7.5
• CVE-2025-1553A vulnerability was found in pankajindevops scale up to 3633…5.1
• CVE-2025-15530A vulnerability was determined in Open5GS up to 2.7.6. This …7.5
• CVE-2025-15531A vulnerability was identified in Open5GS up to 2.7.5. This …5.5
• CVE-2025-15532A security flaw has been discovered in Open5GS up to 2.7.5. …7.5