The Tasty Recipes Lite WordPress plugin fails to verify that a user actually has the required capabilities before creating, renaming, or deleting taxonomy terms. As a result, any user with a Contributor role can add, rename, or permanently delete terms across all taxonomies on the site, including categories, tags, and navigation menus. This flaw is an example of improper access control (CWE-284) and can compromise both the integrity of the site’s taxonomy structure and the broader content organization, making it easier for a malicious user to disrupt site functioning or hide malicious content.

All installations of the Tasty Recipes Lite WordPress plugin with versions 1.2 through 1.2.10 are impacted. No additional vendors or products are listed, and the vulnerability applies to every instance of the plugin across all WordPress sites that use these versions.

The vulnerability can be exploited by any user who can log in as a Contributor to the WordPress site, meaning remote exploitation is possible through the normal web interface. The lack of a CVSS score in the available data makes it difficult to quantify exact severity, but because the flaw enables uncontrolled modification of taxonomy data, the risk is high. The CVE is not listed in CISA KEV and no EPSS score is available, so the likelihood of widespread exploitation cannot be determined from public data alone. However, the ease of exploitation and the potential for further damage from compromised taxonomy suggest that this is a significant risk for affected sites.