The vulnerability arises because the plugin's REST API and structured data rendering functions fail to verify whether the parent post of a recipe is password protected. As a result, anyone who can access the API, even without being logged in, receives the full recipe contents from posts that were meant to be private. This defect constitutes a missing authentication requirement, enabling unauthorized disclosure of potentially proprietary or sensitive recipe data.

All installations of the WP Recipe Maker WordPress plugin with a version earlier than 10.9.2 are vulnerable. The affected plugin is used by sites that embed recipes within WordPress posts and rely on the REST API for retrieval or the structured data that public search engines may harvest.

The issue is exploitable purely through the plugin's publicly accessible REST endpoint, allowing remote unauthenticated attackers to read protected content. Although no public exploit has been documented and the EPSS score is not available, the severity of the coverage suggests a high confidentiality risk. The weakness aligns with missing access control (CWE-284) and user‑controlled key bypass (CWE-639). Because the vulnerability has not been incorporated into the CISA KEV catalog, there is no confirmed, actively used exploit in the wild, but the logical path is clear for someone with knowledge of the REST API paths.