The WP Recipe Maker plugin for WordPress contains an information exposure flaw that allows authenticated users with Contributor level or higher to retrieve summaries of posts through the api_get_post_summary function. This vulnerability permits access to posts that the attacker normally cannot edit or read, including password protected, private, or draft entries. The weakness is a classic case of excessive data disclosure, classified as CWE-200.

Any WordPress site installing WP Recipe Maker v10.2.2 or earlier is affected. The flaw exists in the plugin’s core API code, regardless of the overall WordPress version, so all sites that rely on this plugin and have users with Contributor or stronger roles are at risk.

Given the CVSS score of 4.3 and an EPSS score of less than 1%, the vulnerability is considered low to moderate severity and is unlikely to be broadly exploited. However, the impact is significant because an attacker can obtain private recipe data. The likely attack vector is through an authenticated REST API call to wp-json/wprm/v1/get-post-summary, where the attacker supplies a post ID of interest. Access to this endpoint is insufficiently restricted, allowing the extraction of post content. The lack of inclusion in the CISA KEV catalog further indicates that there is no known active weaponized exploitation at this time.