Cross‑Site Request Forgery (CSRF) in the Yummly Rich Recipes WordPress plugin allows an attacker to force an authenticated user to submit a request that modifies website content or settings. The vulnerability permits unauthorized requests to be sent with the victim’s cookies, potentially altering recipe data or other plugin‑managed content. It is classified as CWE‑352 and has a CVSS score of 4.3, indicating moderate potential impact.

All WordPress sites that run the Yummly Rich Recipes plugin version 4.2 or earlier are affected. The issue is present from the oldest available release up to and including 4.2. Addresses are available on WordPress and on third‑party advisory sites; the plugin is maintained by Yummly.

The EPSS score is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low to moderate exploitation likelihood. The attack would typically be performed through the victim’s browser by sending a crafted URL or form, exploiting the lack of CSRF tokens. As the plugin does not include mitigations for forged requests, an attacker could trigger unintended actions as long as the user remains logged in.