WP Recipe Maker, a WordPress plugin, contains a missing capability check on two AJAX endpoints—'ajax_search_recipes' and 'ajax_get_recipe'. Any authenticated user with Subscriber-level permissions or higher can invoke these endpoints and retrieve recipe data that should be restricted, including drafts, pending, and private recipes. This unauthorized data access constitutes a breach of confidentiality and is classified as CWE‑639.

WordPress sites running the WP Recipe Maker plugin in any version up to and including 10.2.3 are vulnerable. The issue resides in the plugin’s core code that handles AJAX recipe lookup and retrieval; it is independent of the site’s WordPress core or theme configuration. Authenticated users with Subscriber or higher roles are able to breach the access controls, while anonymous visitors cannot exploit the flaw.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% reflects a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must possess at least Subscriber credentials, making the attack vector internal but legitimate user context. If such credentials are compromised or misused, an attacker can read sensitive recipe data before a vendor patch is applied.