The vulnerability resides in the WP Delicious WordPress plugin before version 1.10.2. An unauthenticated AJAX action called recipe_likes is missing an authorization check, enabling attackers to update post meta data for any post. By sending crafted requests, an adversary can inflate the like counter and append arbitrary identifiers to the stored list, effectively tampering with engagement statistics and potentially gathering additional data. This weakness does not allow code execution, but it corrupts data integrity and can be abused for defacement or spam mechanics.

The affected product is the WP Delicious plugin for WordPress, any installation that uses a version older than 1.10.2. The issue relies on the plugin being activated and the recipe_likes AJAX endpoint being exposed publicly.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is below 1%, indicating a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV inventory. The likely attack vector is via an unauthenticated HTTP request to the AJAX endpoint; no special user privileges are required. Once the endpoint is hit, any target post can be modified, making the risk moderate to high for sites that rely on the like counter for business or reputation purposes.