The WP Recipe Maker plugin suffers from an insecure direct object reference in its REST API. The endpoint responsible for Instacart integration uses a permission callback that always returns true and does not verify the user’s authority to modify a recipe ID. An unauthenticated attacker can supply any value for the recipeId parameter and overwrite the wprm_instacart_combinations post metadata field, effectively altering or corrupting recipe data without any authentication.

WordPress sites that have the WP Recipe Maker plugin version 10.3.2 or earlier are vulnerable. BrechtVds is the recognized vendor for this product. No other vendors or products are listed as affected.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is reported as less than 1 %, suggesting a low but non-zero likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, reducing its immediate exposure. An attacker does not need authentication; a crafted REST request to the exposed endpoint can modify any post’s metadata. While this does not grant full control over the site, it can degrade content integrity and potentially manipulate user-facing information.