CVE-2026-1558 WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference IDOR in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permissioncallback being set to returntrue and a lack of subsequen...

CVE-2026-1558 WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter

The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference IDOR in versions up to, and including, 10.3.2. This is due to the /wp-json/wp-recipe-maker/v1/integrations/instacart REST API endpoint's permissioncallback being set to returntrue and a lack of subsequen...

WordPress WP Recipe Maker plugin <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter vulnerability

Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter vulnerability discovered by Quốc Huy jtwings - Puramu in WordPress Plugin WP Recipe Maker versions = 10.3.2...

networkrecipe-sql.txt

network recipe.php SQL Injectionrecipeid AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MAiL : [email protected] DORK 1 : allinurl: "recipe.php?recipeid" admin login=siteadmin EXPLOIT :...

network-sql.txt

network print.php SQL Injectionrecipeid AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MAiL : [email protected] DORK 1 : allinurl:"print.php?recipeid" admin login=siteadmin EXPLOIT :...

phpnukerecipe-sql.txt

php-nuke Recipes SQL Injectionrecipeid AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MAİL : [email protected] DORK 1 : allinurl: "modules.php?name=Recipes"op=viewrecipe DORK 2 : allinurl: "modules.php?name=Recipes"recipeid EXPLOIT : after recipeid...

CVE-2006-6220

Multiple SQL injection vulnerabilities in Recipes Website Recipes Complete Website 1.1.14 allow remote attackers to execute arbitrary SQL commands via the 1 recipeid parameter to recipe.php or the 2 categoryid parameter to list.php...