CVE-2026-1558

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permission_callback being set to __return_true and a lack of subsequent authorization or ownership checks on the user-supplied recipeId. This makes it possible for unauthenticated attackers to overwrite arbitrary post metadata (wprm_instacart_combinations) for any post ID on the site via the recipeId parameter.

• CWE-639

• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.3.2/includes/public/api/class-wprm-api-integrations.php#L40
• https://plugins.trac.wordpress.org/browser/wp-recipe-maker/tags/10.3.2/includes/public/class-wprm-instacart.php#L110
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464195%40wp-recipe-maker%2Ftrunk&old=3441130%40wp-recipe-maker%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/90a5589f-f0e9-4511-9c5e-0afcee0824d5?source=cve

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15567A flaw was found in Wildfly. A remote unauthenticated attack…7.5
• CVE-2026-1557The WP Responsive Images plugin for WordPress is vulnerable …7.5
• CVE-2026-15570An improper restriction of URL schemes and destinations in t…7.1
• CVE-2026-15572A flaw was found in Keycloak's Dynamic Client Registration (…8.8
• CVE-2026-15573A flaw was found in Keycloak's Authorization Services. The c…8.1
• CVE-2026-15574A flaw was found in the vllm-orchestrator-gateway component.…7.5
• CVE-2026-15581A flaw was found in the TrustyAI Service (TAS) deployment. T…8
• CVE-2026-15583A confused-deputy flaw in Grafana MCP Server allows an unaut…8.6
• CVE-2026-15584A privilege escalation vulnerability was found in the inclus…7.5
• CVE-2026-15587Improper Privilege Management in Google SecOps (Chronicle SO…9.4
• CVE-2026-15588A denial-of-service and resource exhaustion vulnerability ex…5.3
• CVE-2026-1559The Youzify plugin for WordPress is vulnerable to Stored Cro…6.4