Description
Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.1.
Published: 2025-12-09
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WP Delicious plugin suffers from a missing authorization flaw that allows attackers to perform unauthorized actions on recipe data, potentially exposing or modifying content and undermining data integrity.

Affected Systems

The vulnerability affects the WP Delicious WordPress plugin for all releases from the initial launch through version 1.9.1. Users running any of these versions are susceptible.

Risk and Exploitability

With a CVSS score of 6.5 the issue presents medium severity; the EPSS score indicates exploitation probability below 1%, and it is not listed in the CISA KEV catalogue. The flaw can be triggered by a web request to the plugin’s endpoints without prior authentication, making it exploitable over the public web surface.

Generated by OpenCVE AI on April 29, 2026 at 19:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the WP Delicious plugin to version 2.0 or later, which includes proper access control controls.
  • If an upgrade is impossible, disable or uninstall the plugin to eliminate the attack surface.
  • Review the site’s role and capability settings to ensure that only trusted user roles have permission to use the plugin’s features.

Generated by OpenCVE AI on April 29, 2026 at 19:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Wed, 10 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 10 Dec 2025 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpdelicious
Wpdelicious wp Delicious
Vendors & Products Wordpress
Wordpress wordpress
Wpdelicious
Wpdelicious wp Delicious

Tue, 09 Dec 2025 14:30:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.1.
Title WordPress WP Delicious plugin <= 1.9.1 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

Wordpress Wordpress
Wpdelicious Wp Delicious
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:14:20.589Z

Reserved: 2025-12-09T12:21:17.726Z

Link: CVE-2025-67548

cve-icon Vulnrichment

Updated: 2025-12-10T21:26:19.034Z

cve-icon NVD

Status : Deferred

Published: 2025-12-09T16:18:30.350

Modified: 2026-04-27T17:16:42.560

Link: CVE-2025-67548

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T19:45:18Z

Weaknesses